8c37caf4ef8de37500c24f5d6e94b0dccde100819e16a51a62be855eef5722dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RESUME HENRI JULIANE.pdf
Size 196KB
Sample240603-p8ltasfc2v
SHA256 8c37caf4ef8de37500c24f5d6e94b0dccde100819e16a51a62be855eef5722dd
MD5 032610ee26293b22873f2c50af56e6ef
SHA1 7e93e6d192de7cac0de7e30bb4a85d6642d8081c
SHA512 8207c368c2c8d649cf91a00c9a3aa289d76a94d68f3618de7338b9cf8243b0b544fbdae4e0e223b63159776c06134115763615c41c1461fa36fd2931de480061
SSDEEP 3072:eJA2VLlRYyZ5rwXyn+wGJ5GWBJDY6j4UxxLHhaTde+UsjkjeHUsXndXF:8A2VLv5q3J5G+pTLHJ+xK94nd1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4080	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3000	4080	AcroRd32.exe	88
PID 4080 wrote to memory of 3000	4080	AcroRd32.exe	88
PID 4080 wrote to memory of 3000	4080	AcroRd32.exe	88
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 2336	3000	RdrCEF.exe	89
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90
PID 3000 wrote to memory of 4760	3000	RdrCEF.exe	90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RESUME HENRI JULIANE.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E81627054FDF40493DB38BF0D59AE2A1 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2336
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3EF4C783397E49FC59700C65312DFB87 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3EF4C783397E49FC59700C65312DFB87 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5D9FFA47023C955EB966BAACBFCF759B --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3908
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D1245D6E0B0E88314DAF7879FAB70877 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4116
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5F696DF4394A943CD890BCFD19D831B3 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:744
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=609B0AD0DDD64330C7B51F62C4F3475C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=609B0AD0DDD64330C7B51F62C4F3475C --renderer-client-id=7 --mojo-platform-channel-handle=1920 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 a04099cc1bb5e8818ce4f34deecdd9d3b6711857cd198be57f7113f899cb083e
MD5 b302d9519323503a2b312643f278ae20
SHA1 3a75557283a90dad8820c36789fa8933df019e68
SHA512 7e567046b2743613d5934f56454dd22086618c2240053c3a3ccd415788ffb947bd322d0a0373e64916c60f87d4afb65166c8330387413184eba77cbd7493d0bd
SSDEEP 384:yeLdThP0tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:j0+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download