b14acc608aa53082828691eccf8ee9c153393ea2155d48adc84bc47f024082a9

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5181d23beb108c934b8967d68bcfed046652856b816dfb0e37684ea0d6d8b44f.pdf
Size 46KB
Sample240612-cfkz3sycpg
SHA256 5181d23beb108c934b8967d68bcfed046652856b816dfb0e37684ea0d6d8b44f
MD5 6efe4599f1220f7f2e5e068c615e644a
SHA1 b15354524f969f71f6dd1a8d7a8a72effd3f5eaf
SHA512 13e05630e7c0595dd90fdf667dd99be0ced46d3ab6c7b9687dc2d86d41fd2bf9a5de3f448f2a8be0d0192a665309a2c3c0359f7d61eda47aff48e47698e1e82c
SSDEEP 768:pss28gzqeUC/bLufNa+r6X6dSMCz+MB1br9r879O/S0RjcgjgxGCGqdVkk44AIFm:3ne9XufNa+r+6dSMYP9rW9adc7xGFqdo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4328	AcroRd32.exe
4328	AcroRd32.exe
4328	AcroRd32.exe
4328	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2204	4328	AcroRd32.exe	85
PID 4328 wrote to memory of 2204	4328	AcroRd32.exe	85
PID 4328 wrote to memory of 2204	4328	AcroRd32.exe	85
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 3632	2204	RdrCEF.exe	86
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87
PID 2204 wrote to memory of 4312	2204	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5181d23beb108c934b8967d68bcfed046652856b816dfb0e37684ea0d6d8b44f.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=847902097A17FAEAC41B4C804D15C5C1 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3632
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=759D06297BA029563C1EC398D46F270B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=759D06297BA029563C1EC398D46F270B --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=95E52515F6BF8ADB5D283CB8085CB0B0 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D843122F52E91B58C0AC5BB7C9B7E8C5 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2496
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FA70F203A4D2051D20F913AC4CD9E758 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 54c0b33270d692d474211ade479ddc7497a63479c36501e0089c71ed1a94add2
MD5 b478b5285d81ec38f8e9298a7896b331
SHA1 1a7b21f7dd6fd58125d7ac3b184863bf58c5e0ab
SHA512 ffb8bf551d68ccaa446c311857692baae85b490910bb030ea2ab979631f40b8218da889e7345416ac973ca72b9a48407196ea7a604b1f56e35432a3ccb47c9f6
SSDEEP 384:yeMdThptELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:k+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download