1c371280ef5ddb832d5534e015869a5fe79a379649c64b69160533b81a219e46

Analysis

max time kernel
127s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf
Size

856KB
MD5

47078052d5ab665b327be8e36a6599a8
SHA1

dfb8db0769a680baceba07f07d15ab2dd6d44baa
SHA256

c5cd043fb57b0ff49d539ba937460c8f048c03984bccd544b9a0a8010e8b4cbf
SHA512

3592af9494cb8c1e51206aaf1b09f7cda203f06d44c94bbe46a5ba56dd98638bdb8676778b8ed50f19dec47be497dd6d3a75618d7623b0a657b9196239a10b67
SSDEEP

12288:DccFx6IUA/GREWcchalfMj+BMpWccc43WeEImLgjVccJIhGcdvQEzs:DD0IUDgCqJ2xeB6gjVyrds

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4404	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4404	AcroRd32.exe
4404	AcroRd32.exe
4404	AcroRd32.exe
4404	AcroRd32.exe
4404	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3844	4404	AcroRd32.exe	89
PID 4404 wrote to memory of 3844	4404	AcroRd32.exe	89
PID 4404 wrote to memory of 3844	4404	AcroRd32.exe	89
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91
PID 3844 wrote to memory of 944	3844	RdrCEF.exe	91

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIR FORCE\LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EF46A2FB240C9D704AC973F2A1F93C0E --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5040
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EA42E783C45F6DAD0E71C2BBBB2CBBDF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EA42E783C45F6DAD0E71C2BBBB2CBBDF --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CB23E9D0A73FC2397B7907B90CB6E3FD --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3244
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F8003DE980EFA86749EE643EA8D18EF0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F8003DE980EFA86749EE643EA8D18EF0 --renderer-client-id=5 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3664
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D8D1F3848F6FEA5D126B3F5489A89092 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4868
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F536FE62A3920A3136A02767F4DEF06E --mojo-platform-channel-handle=2724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
fd7fe1283dd2b8efa3bce49148fb75d6

SHA1
efd30d229dd45f4e2d0199c81420ff0fb19b7239

SHA256
86ff18f7130abb5e4c404db9175745477660fe8aab96c89f9307e8d7b32e1df3

SHA512
b8b9f017b08681c82ed50a9bf25a58c58ea27051af8d5120f444bcb865be6a1bd682ae74813e590b44750d2838e8baa786f4dffb5ba1d7ecf0e700691f205c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
2aa21ae60507c62c0bc27ea3e3b8f750

SHA1
3d4a1ac4261293ce1b2f3394120200cad46297ee

SHA256
597ac250011456643057ed1d337d76c5e41cb031b55c3dc524a86645e06f15cc

SHA512
a5d3b18236a84d290e94e5a2623455355a2552ecb9b3ff8cac4690663c30ac4a2e0493aca06867c050e1fdfa7ea12ca1f05023f9ceb0d66135dc75517f928fb9

Download Submit