3eae06ef5ef95a768a457656903b37c67d041388350963cec0d6d73ce5acc740

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3eae06ef5ef95a768a457656903b37c67d041388350963cec0d6d73ce5acc740.pdf
Size

783KB
MD5

dbf247706d4917263bf8945dfd750aff
SHA1

a6fb0ccafef6314ff640e39d777a1012b45ed9c3
SHA256

3eae06ef5ef95a768a457656903b37c67d041388350963cec0d6d73ce5acc740
SHA512

0891484d93c7a2daaee8caa6ab02366f5196c2445f72500a125918647384f9d9d4f08844c286e4528926d2042c91b0c6570c87c3700ca1d49977b93e81557a2c
SSDEEP

24576:GMQBqLwtS8Guoiq9itWsZW9VesQKfFDK9:ng+NiAGgQ+O

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
924	AcroRd32.exe
924	AcroRd32.exe
924	AcroRd32.exe
924	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2996	924	AcroRd32.exe	84
PID 924 wrote to memory of 2996	924	AcroRd32.exe	84
PID 924 wrote to memory of 2996	924	AcroRd32.exe	84
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 2752	2996	RdrCEF.exe	85
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86
PID 2996 wrote to memory of 4176	2996	RdrCEF.exe	86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3eae06ef5ef95a768a457656903b37c67d041388350963cec0d6d73ce5acc740.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8B59F8754825F961AAB8D04636FD9D07 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2752
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=09DEF8750946BDC8D1679BD24930F64C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=09DEF8750946BDC8D1679BD24930F64C --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AC45C5E5695CE7A52FC7FDB5FC125C7 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2528
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=27161276C57397F80E28179130BB193F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=27161276C57397F80E28179130BB193F --renderer-client-id=5 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A716865A40420163C71344D080CEA848 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:440
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7F3705B9006916824DABEC89981B6C91 --mojo-platform-channel-handle=2708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ccd893e3be58286f60ef237a210a85d4

SHA1
83ef8feb032ecb0314faffa7f969342fde942209

SHA256
b1b9b5b32d4d63323ddaf2689b4743e8f1a212fbfca6998651c9c88739f703c9

SHA512
0d261e038179bcc5049a4bc6142ea97b83748efc9e1b92603f6ff1f82589fcf46a8a84f3bf9a4ee6ee4d99d126c251c120b0a5556e4b81fec884b9d4b47104f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
61bd0f75c4839e6de36434c3b1ec8cb6

SHA1
dc389bd6a76ae53a90a647c0b6bd7abf1d8a0d94

SHA256
0d0334721592cdadf91ea711bf02b94023c0f74b5fabfaf41a383eb697585fd5

SHA512
60877e29332508895f2c8952fd3e5472ad643fd8b30281847bf4009db71cfd1dfed4c4ffe87718c0a9e5b62f21bb9816fc3e6b61c2353cc25be071990c17a5de

Download Submit