c4ccbd2498bedc2e0d58db158a1a233e567bcdf4a24d0a84e9e1c6b393f5ca09

General

Target

0473a6003e5bfb415faa3c7d291a9700_NeikiAnalytics.pdf
Size

309KB
MD5

0473a6003e5bfb415faa3c7d291a9700
SHA1

9acb0706a882b0bd9b24be7f0b8ef753204e87f3
SHA256

c4ccbd2498bedc2e0d58db158a1a233e567bcdf4a24d0a84e9e1c6b393f5ca09
SHA512

b0b89d382d5ce61343a1b0bc1f0d041aff375c00ed3738e9a6adb08174582d53983fbda323edb0f9b41221620d351754a0cc9111bf8c5751f003f6cfd64d3112
SSDEEP

6144:s5SJF6LvvDccQB8KF8IJyBDtbnhOe+8sXx9UzrAkmN4VJ7cH9T1FD9pHqt:s5kyLq8UcDtnhOelUx9UzrAk+4rUdjDk

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2872 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

2872 AcroRd32.exe
2872 AcroRd32.exe
2872 AcroRd32.exe
2872 AcroRd32.exe
2872 AcroRd32.exe

pid	process
2872	AcroRd32.exe

pid	process
2872	AcroRd32.exe
2872	AcroRd32.exe
2872	AcroRd32.exe
2872	AcroRd32.exe
2872	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2872 wrote to memory of 1436	2872	AcroRd32.exe	RdrCEF.exe
PID 2872 wrote to memory of 1436	2872	AcroRd32.exe	RdrCEF.exe
PID 2872 wrote to memory of 1436	2872	AcroRd32.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 4108	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe
PID 1436 wrote to memory of 552	1436	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0473a6003e5bfb415faa3c7d291a9700_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=58F1C2E8E68FDF7D65CBD76E6649CE00 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4108
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B4511B59CCE41EA621F7C49DB4CB7F94 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B4511B59CCE41EA621F7C49DB4CB7F94 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB360329387570F8E610E02C39D485AC --mojo-platform-channel-handle=1808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4768
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=10B1B1803D71F501A99FB0303944F300 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3792
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=323473AF831D54360A43F7ED9D49BE3F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=323473AF831D54360A43F7ED9D49BE3F --renderer-client-id=6 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2420
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=81380A88FB3E093F67C4C42EB7432AB6 --mojo-platform-channel-handle=1880 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
1944650e61858c0720163ee9af5c85a1

SHA1
bd7819e80b1ca2d089d4d0501c309332639c30bb

SHA256
b9791d24750c38b8214e23d6239568003f49364673daafd6effa395b44afd988

SHA512
c5d1f1f18d233f60033b13f4e49ebb60a597ccc90a31b7e4088de4fb0f2181b7475e972360b7b1939012e2ddbddbdcb3f96eec78a23dc3bfc6764470efcba4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
dfe4f7107fa2add947ccc40dbd7166a3

SHA1
0a6f3e7bd5c26ca40863f6f7cc27e87ec67cfb93

SHA256
e52e6c9072ded0f7a7c5bfbbb2be9cdc769c365104775f6a738a5be67f1a7f3c

SHA512
cf399e8ab4a1559772e3542cbd5daf1672b102545a424ad1da8f41c2118d9c742e379b8032db09f9d107c9cf17500aa348832456bba1d9c91faf6ba9e0e8f4f2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads