61cb3d276b5aa702bf29b9ab1201e9819b321dfa70b545ec537e90763f365397

General

Target

61cb3d276b5aa702bf29b9ab1201e9819b321dfa70b545ec537e90763f365397.pdf
Size

95KB
MD5

82839e475cedf7061ffb076371bdf164
SHA1

d88d2d6c5d7c229d7f123ec1e362a08f6d5493c1
SHA256

61cb3d276b5aa702bf29b9ab1201e9819b321dfa70b545ec537e90763f365397
SHA512

e97a700587a52ed4c2a16618cb557971cda97efba2b9284d842a45c69e3b36706aac21ff2ce146b7cb9d94b103edf1b018efb6dd850b653d6c9123226526d43c
SSDEEP

1536:adzknKk36OJ8t4LmgeKAYLq0N3TQKLtlq3LyREEoHuqkxY/gJXI281rIscIIOovD:qzknK5OJ8t4qg9dDJDqeRukxggK281nu

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2568 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2568 AcroRd32.exe
2568 AcroRd32.exe
2568 AcroRd32.exe
2568 AcroRd32.exe

pid	process
2568	AcroRd32.exe

pid	process
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2568 wrote to memory of 3108	2568	AcroRd32.exe	RdrCEF.exe
PID 2568 wrote to memory of 3108	2568	AcroRd32.exe	RdrCEF.exe
PID 2568 wrote to memory of 3108	2568	AcroRd32.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 3156	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe
PID 3108 wrote to memory of 4132	3108	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\61cb3d276b5aa702bf29b9ab1201e9819b321dfa70b545ec537e90763f365397.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:3108

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F5B9E35BE9AD936DB23C63FE9C8CF3F6 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3156

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4ACFBDA4D745A16CCD475F8A6F34EFF3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4ACFBDA4D745A16CCD475F8A6F34EFF3 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4132

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F7E07BEBAC726DA925D20A1783FD4995 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A9A4EA3B84212E0881026E6EDAE296D0 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2084

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4B2A103859A1CC9860A0B76AAF1B4254 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4B2A103859A1CC9860A0B76AAF1B4254 --renderer-client-id=6 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=543602EDD01B79C961E2D0DEBDDCEDE9 --mojo-platform-channel-handle=2764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
b9ea14e9f36869f3a18e2ee11d5b8cc9

SHA1
53be658fe6483a7e14086706474e44a97a9476dc

SHA256
73b958301c91769374484150a535467f2369f6130f4e552c95c1b8c56db80cc9

SHA512
1e27444c9c8eb8123b8529db65ed4c5e6c12153cb2c153ddd59b9ecb34c3545be6471728d17754f51748714ea914eac9144b35f1928f50cd1e21d41d12af3a54

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads