bdb1bac9b73b9e2bd041441507d7c2a889299d7e455fac772cc7aea68e02a79f

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
malwa1.pdf
Size 47KB
Sample240612-23cdwsvakc
SHA256 bdb1bac9b73b9e2bd041441507d7c2a889299d7e455fac772cc7aea68e02a79f
MD5 a5852fc71a865e1fc71bebb000ee9a14
SHA1 a6ce210b4b1b24c62315633dfd3ad62623f02b16
SHA512 ab9341c20a3e9a001aef88160dae446f4beff106ec54668d145f6397ed440dd429207e779918c543fc4397eb72e2fff82912c5ad6ec52d3fccc1ce5b86011249
SSDEEP 768:7Ye339eSZgQOPLEtiAMXWo1NUexmJhcq4xVFCc3E1oGahz7p:t3NlOQqQwWONUexGiq4xX0aGahfp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
884	AcroRd32.exe
884	AcroRd32.exe
884	AcroRd32.exe
884	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 668	884	AcroRd32.exe	84
PID 884 wrote to memory of 668	884	AcroRd32.exe	84
PID 884 wrote to memory of 668	884	AcroRd32.exe	84
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 552	668	RdrCEF.exe	85
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86
PID 668 wrote to memory of 2844	668	RdrCEF.exe	86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\malwa1.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6F5D1B1CFB4DD7E7B1E049A96F7A6D48 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:552
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1F12046B7BF6F32CB1B5A412E3868880 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1F12046B7BF6F32CB1B5A412E3868880 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7954E2EAB63B9467939773B5071B120F --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=56B6F948A74BF4EE48DA09C85988262A --mojo-platform-channel-handle=1960 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2860
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=49583911F786F1E7F8E5935779C8E9B6 --mojo-platform-channel-handle=1840 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1752
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=54F79442F384B52FC44005122EC1FA30 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=54F79442F384B52FC44005122EC1FA30 --renderer-client-id=7 --mojo-platform-channel-handle=2516 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 5e6a2c5c4eeaf29553ee6698c76de2d12c57bcb18a2517c66c22c1a843274fab
MD5 2320049aa33102d404112923eae98895
SHA1 8c5e0dfe25e1e0d6d49f9c0ce11d727fcefd8cfa
SHA512 3cd376c5b00a3d23c726e1cb77ad443d257f295772992636a30852473b343a5c662738c2cd8c92c443746e6910a8df29e1edf7ecbb08acb00ab9d3ab46c5d763
SSDEEP 384:yeMdThPAtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2A+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download