175cb80c5dfd9b164ec16eb3f8e95879c701f502fd3d59250934b436b035b6fd

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

155c1aebd9f1004f41c5e70eee83b890_NeikiAnalytics.pdf
Size

624KB
MD5

155c1aebd9f1004f41c5e70eee83b890
SHA1

9a039886ec780cf998d60a8def135a3560125619
SHA256

175cb80c5dfd9b164ec16eb3f8e95879c701f502fd3d59250934b436b035b6fd
SHA512

636bf77955dec85790e9de40eaf4888eb10489fd1e117e7041cefc58d90be70df6cc5482a8c8c12bfc06b5a182af5760528b01323b01abcf1df86aa876ed3aa1
SSDEEP

12288:Z179mLajqTZP0gMnl2ZpT2AmxSVmgpE7CKqaqIKkFEOJKmgRZxvtJezOjqAm1:H79aajidiQZpSAmymgp6CKFq9MQmyZQl

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3304	4808	AcroRd32.exe	89
PID 4808 wrote to memory of 3304	4808	AcroRd32.exe	89
PID 4808 wrote to memory of 3304	4808	AcroRd32.exe	89
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 4356	3304	RdrCEF.exe	90
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91
PID 3304 wrote to memory of 3212	3304	RdrCEF.exe	91

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\155c1aebd9f1004f41c5e70eee83b890_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BEFA6C347D6A3E5FA8D21B38783F0D31 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4356
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AE20542221903592FBB43B7645106DA3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AE20542221903592FBB43B7645106DA3 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A7300F2F0738B93AAD9C434A4EA9439 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4256
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7401D20067BDD069D9A94221125589A8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7401D20067BDD069D9A94221125589A8 --renderer-client-id=5 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=44463CA522DF4F8A7E4F670C9CB2DAFA --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4068
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1C16E3728A457B320C72BEDB9F623206 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
7a7836d9f1fc16c4b325225745947b31

SHA1
7997ee1b3669380d03cbb1c418f422b6c48ed1d7

SHA256
b0a2c5a1cd962ecf76497bf3187a68b4540bbd2e680c8d74824dd4e86908097d

SHA512
f70e73414f72485b5ac650092c5c93cea16f86293d7a4c36415d52b89a4e327c7e129c70027c81de3e0d3c7a38e6056805538494f4e662e23ae20edfe6626fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
8784dc4b42d697bf037068726b9ace75

SHA1
c66358eb190133fd7ad110976af14caa0395b80a

SHA256
7f7b740f6021104db7b7fcbbd001d9d0c86762a204202e83187de1164cf4be5e

SHA512
de5df300282b73c1ff03ff7d7f25352338cf2be51bbfa26edb182620781b34ebeca4eadf13b2aad03661d78773f9f5c631a264bca22d8020f92e732ebe954965

Download Submit