1f723852e437769e62ac178e81ec552e46820bbfd55ec8763c02d3da554c1bcb

General

Target

3. Kadınlarla Tanışma Rehberi Modül-3.pdf
Size

2.2MB
MD5

3c008889d4cf0e1d2961d8b65c8fd3c7
SHA1

2162de0c27de46564f847793d224865ad7aa1217
SHA256

7f5c9e550013bde9ee546216a018c1dc50212576f5c2c423274a6270cd256d49
SHA512

529cb2243332adf98ac459a6c64decd2a0150d76f0f550c77b2165d9977f30d5aeddf10891e358bbd37f7280016e34e2d6177044bf46d1462407d7fd608bcdc6
SSDEEP

49152:RioBMS3kHHR7LQlD+7lLa1dQTJ9sXPxARjG6DlyV:RioGV7LQlD+79a0TJ9sX58j/I

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe
4748	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4748 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

4748 AcroRd32.exe
4748 AcroRd32.exe
4748 AcroRd32.exe
4748 AcroRd32.exe
4748 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4748 wrote to memory of 3324	4748	AcroRd32.exe	RdrCEF.exe
PID 4748 wrote to memory of 3324	4748	AcroRd32.exe	RdrCEF.exe
PID 4748 wrote to memory of 3324	4748	AcroRd32.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 2328	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe
PID 3324 wrote to memory of 1616	3324	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3. Kadınlarla Tanışma Rehberi Modül-3.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:3324

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DCE105B6C23446127AB7A44963E1671F --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F85DF8F70CDF3E102D44BEDEFF26DF16 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F85DF8F70CDF3E102D44BEDEFF26DF16 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1616

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5A75FA3E180CD060D34304C4928B737A --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4608

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9812F028C82BEAC90CB7DE392CD04620 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9812F028C82BEAC90CB7DE392CD04620 --renderer-client-id=5 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3152

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7B1AB5CC1F3D1170DFBBCC9D7ED32D00 --mojo-platform-channel-handle=2732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D024E8A7BF28ED129341CEB543185B5 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ee34b2eb214d1ad9ecfe27a17be8e090

SHA1
26e77ba5cd317ea291bc784a2bf9ded8590780dc

SHA256
445a17ce85550f1d78a0bdc72c976c1ff9c017f37cafc2093e3ce3d46b74b91a

SHA512
ce7aca3cfaa64b2b21ddb25099ef2f0588635ad0ec46af1298a831f0fdcccd5ed30b846462fd4bd12fc0184f3d8db798ddaa229c37521467f9b7b5bf83c7a21d

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
c9117d77441f05fc9d81ab168bfbe96d

SHA1
561ef99917c21fe002d261e8cf907815897e69a5

SHA256
0f1cf5882ec9a572e84c3c6e97e723b7964e89c7daa6d17ae937239bf6f6e1cc

SHA512
922a0276744d4ba86f88f050034cb396d617e0d21d7091ee92cf1e9e348f8d3086296a5ba9b7451d8043b3c0612cc48c59c0b2d0bcc2820e35b1cb8ba982ccf6

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads