65ae76bfbb804d74b93071df809ce5ee36d2a7819a1a7a4dae0652f7e168553d

General

Target

6b9b8a98640808a52c870c83119b9bb0_NeikiAnalytics.pdf
Size

305KB
MD5

6b9b8a98640808a52c870c83119b9bb0
SHA1

fa2faf2227bead6622cf9a34a00dc37ec4d88b65
SHA256

65ae76bfbb804d74b93071df809ce5ee36d2a7819a1a7a4dae0652f7e168553d
SHA512

3707d22276ab7975f024e5f87ac8bd8b21f72ff8960f887abf7b55526b2887ee1af8bf44edd419cc500e02b3908c3103d9e4220c5474d4c00067e7ddd97a5376
SSDEEP

6144:Jffy6wbfsB6N3qyz7D62ujmIerrC9pM+VNl/tZ3iaJoQDrrMlWDLQAE:N6fa6N3hz7D62uj4Gn3P/HrMlWDLZE

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3380 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3380 AcroRd32.exe
3380 AcroRd32.exe
3380 AcroRd32.exe
3380 AcroRd32.exe

pid	process
3380	AcroRd32.exe

pid	process
3380	AcroRd32.exe
3380	AcroRd32.exe
3380	AcroRd32.exe
3380	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3380 wrote to memory of 4816	3380	AcroRd32.exe	RdrCEF.exe
PID 3380 wrote to memory of 4816	3380	AcroRd32.exe	RdrCEF.exe
PID 3380 wrote to memory of 4816	3380	AcroRd32.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 2212	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe
PID 4816 wrote to memory of 3836	4816	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6b9b8a98640808a52c870c83119b9bb0_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B376BDB4091D1BFD6038F658947AE8C8 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2212

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6BAF6005787C4B38E1A62095D3FAF6CF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6BAF6005787C4B38E1A62095D3FAF6CF --renderer-client-id=2 --mojo-platform-channel-handle=1916 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3836

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A80403A82B720FFBF7FEB671E4F36E81 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2228

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EDEB62E7A3A29ABE31E7B31F490F76FC --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4892

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=97CB5CA61F6CF5C928017AB8118CAAD0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=97CB5CA61F6CF5C928017AB8118CAAD0 --renderer-client-id=6 --mojo-platform-channel-handle=2528 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4476

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1C78092038D4B701826A46C352D98267 --mojo-platform-channel-handle=2708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
74a64122f02d0ae6e238393ceeb156ea

SHA1
362fd6197c5d6b7d1825e007815435920488052e

SHA256
33d78834abcbdb38776d2e73ae7ca27b7ff042a0cc2d63417fc4e2ad2d8e57a5

SHA512
35b72fc300476f69b42658ed904548deba90ce8e04ef47de999c6b52ceb7a3ecc47a0fe127e98eade49330b7ccc9dc7b651793e64ed19f2d221d574f5cbb1f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
1da911bcc9feab9788a0ca9359586f63

SHA1
6dae2306d9e65f99f1c4770ab9b14cda6f90b559

SHA256
cac6638cd19f83a9caedd35fb7862c4486cabb1e0b1593b2c918050b80bf1d1f

SHA512
59767b5450aebf2155e15e2d6b8a2942b8f31649d4577e3619a018a2aaf0458154da6fbc380271ef68c0a47e577761191a43384630164d1cee4e181058a04a1f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads