0ade4b4095908776921305fb046e47bf0a1f306af9590dcd425e951e3df9a412

General

Target

16456cb77c910d2cf50a8a067df6b990_NeikiAnalytics.pdf
Size

2.2MB
MD5

16456cb77c910d2cf50a8a067df6b990
SHA1

379ecc874dae242d9003dfaa1f39608e7f86ddea
SHA256

0ade4b4095908776921305fb046e47bf0a1f306af9590dcd425e951e3df9a412
SHA512

99e7e174bfb16eef0895a55ae20f91d734e8928f0bbf98121c9f55910300e058bbb5ab6366497d2d5c56d97af44d8008bc08219abf0b151d12108d45bd74c311
SSDEEP

49152:jn0vguHXjNWD3bzTEkLK50VrFBsgix8wKMKLyhGAAXHZX:jn0b3RWv9PR7Vix89MWh7

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2720 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

2720 AcroRd32.exe
2720 AcroRd32.exe
2720 AcroRd32.exe
2720 AcroRd32.exe
2720 AcroRd32.exe

pid	process
2720	AcroRd32.exe

pid	process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2720 wrote to memory of 1584	2720	AcroRd32.exe	RdrCEF.exe
PID 2720 wrote to memory of 1584	2720	AcroRd32.exe	RdrCEF.exe
PID 2720 wrote to memory of 1584	2720	AcroRd32.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 5024	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe
PID 1584 wrote to memory of 4832	1584	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\16456cb77c910d2cf50a8a067df6b990_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6A2E8AF44D690066FD446C75B7E0CEAF --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5024

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=126079DD05831515A0311053E8F14810 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=126079DD05831515A0311053E8F14810 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2CAC785FE3D940D2AEC193584C118280 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:876

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5612CED895BF4D212DE695C66B6CBC2B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5612CED895BF4D212DE695C66B6CBC2B --renderer-client-id=5 --mojo-platform-channel-handle=1900 --allow-no-sandbox-job /prefetch:1
3⤵
PID:988

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFE614549171D2841938932561B05928 --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2864

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CBBAF817FD722D9FF7657292481D3F9B --mojo-platform-channel-handle=2796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
3f3f86af344576380b0c793722e83e62

SHA1
8790ea2e46ab6bff4265503081b90079f9b613aa

SHA256
a8a9f09150f12c82bbe42e3face5ad74d6b2b44355d7e049d92499fe417c0f7d

SHA512
39de10f4c15133df246364ec9ce0af8ad7c9f4c400cd75726c88131fc98a2b9a80a017befe9960b73d141be4ac43a17f5299575328419f68fc417f7d8868438b

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
5dce29c43602be290f667058ecdf2636

SHA1
82399486dffd5f86489e2609602a7e913dd580e6

SHA256
2aa52abd0f71aa0454af3a87bf4bf8712a88d1bc9a972b24912aa2d7296ab890

SHA512
3bafe259a03a9ccddd0c0b3d1c6b7864e1c357700df8f78586642c620d06a4c91b4c82401a0224c9e87e043dc07008f0b5d2657d474b872cb917333687f4c4f1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads