2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554.pdf
Size

55KB
MD5

8b14ae7a7d7a596f7a3fa656c2c88c61
SHA1

b37c4122a482c4d36a25dfa6699a79ae6abbb80f
SHA256

2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554
SHA512

725f0a0afac86c5e8746a0d52922238fb218396002f98fe2564b24e1ab26f4867c8bbeb6add46ded19a5e38810642a57f58360f374d47ab79686763620d69d26
SSDEEP

768:D/s9uQVhN7lyl+CyTY2MZ4t6kOkNFtYN6KjEa05wLASVeyrYJ:D/+1VhN7lkVyTY2Mut6kL4zHIsC

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2512	AcroRd32.exe
2512	AcroRd32.exe
2512	AcroRd32.exe
2512	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4396	2512	AcroRd32.exe	90
PID 2512 wrote to memory of 4396	2512	AcroRd32.exe	90
PID 2512 wrote to memory of 4396	2512	AcroRd32.exe	90
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 2888	4396	RdrCEF.exe	91
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92
PID 4396 wrote to memory of 4948	4396	RdrCEF.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BBC188DAB413F09C27753A69675E6973 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AA235276E3C4FE7AF92E82BEBEBA415B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AA235276E3C4FE7AF92E82BEBEBA415B --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=430173043D1DBDBB269D5614C39D9E01 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1144
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=904B517A90153584A05DFF3F79F39BEB --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3296
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0669FAD12D78ACB3779F1BEC9E86E52B --mojo-platform-channel-handle=1848 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:960
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F53A64D13FE250FFBF02B868BF840C76 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F53A64D13FE250FFBF02B868BF840C76 --renderer-client-id=7 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
17b5b0582366b0eac79c721e667fc683

SHA1
c14c43c194c711207fd1f6c25c1fff48e838e1ea

SHA256
76a496eeb0db8caafd1fc48c58e6aede728153aa26889e749e3f9b696011f147

SHA512
14b939ef1b8f96182cd72e3d2c59d68ac72d54cb4659b646dd5f3fa0631db87f2dd1b87a5019fbf427d6395634d0ad6dcd6f900cea267b2360ed23ad62e3900f

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
fc9a71a88908338a0d479e0375da6e33

SHA1
3998de70706e94a96b6f402358dc729a0a1d0082

SHA256
3442ac791a4074e729e5a13c031a799cf4ea238f24a8a295474a14fca8e373df

SHA512
ba500f605e0de87f6b084c8e93d85cf8d7836ab11c1cfd98a0beaddf8a8904a68b58bc4d4d8efdde2255cc9edf40ef51a2673e22553fa9467e593c3305436a9a

Download Submit