8c1e385771af02091bfb3bb0416cbad6bccc5479d75d318b60918ef18dc4b395

Analysis

max time kernel
94s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PELATIHAN STRATEGI PENANGANAN KREDIT BERMASALAH.pdf
Size

149KB
MD5

22813e378dc3f5c18627754256f42c99
SHA1

265193057594119f56ce239be69594200fa83ab3
SHA256

8c1e385771af02091bfb3bb0416cbad6bccc5479d75d318b60918ef18dc4b395
SHA512

5c20caaf193d0b8da7425b9fe46a513a716f9a58b3c1049c556a3565943a9a5da7d5caac664ff3a3e1ecfa626fc5adc9502e5082806f8ef61536e94a674e352e
SSDEEP

3072:Zd8H7xzpyzqhyum1Pk/xrJ+IzwR5s0BapixJuxBTB3maRwElpEYRM3bzJsJ3MWne:8NpHhyumFkZ9bwRSqZJYj3mabxRM3b1j

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3580	AcroRd32.exe
3580	AcroRd32.exe
3580	AcroRd32.exe
3580	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 3484	3580	AcroRd32.exe	85
PID 3580 wrote to memory of 3484	3580	AcroRd32.exe	85
PID 3580 wrote to memory of 3484	3580	AcroRd32.exe	85
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 4308	3484	RdrCEF.exe	86
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87
PID 3484 wrote to memory of 3472	3484	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PELATIHAN STRATEGI PENANGANAN KREDIT BERMASALAH.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=42D0131C5852E39AE7D105248F5A15D5 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4308
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4C0D73C1DC0A71531989E7B3D5EB0989 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4C0D73C1DC0A71531989E7B3D5EB0989 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=55CF3ABE1E2F4DEB616A78F3FCDC8E34 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4568
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8799F68360FF0BB64FA502ABCC546B2F --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3304
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D230A0EA4646C4F2A26A3C6FE820B01C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D230A0EA4646C4F2A26A3C6FE820B01C --renderer-client-id=6 --mojo-platform-channel-handle=2504 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=88A17669F72B33ACF4ECDE472CD8E138 --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
bbf0c7df4fb8cc054f64048aee8a3b42

SHA1
452c5753d99b1bbe0901ab3cd580caf218bb7d48

SHA256
503a5bb31e9c6e3946c3a5c22e74fd3c972fe2d97d7828eff98f16f544d82a6e

SHA512
7d9ca44461fd926c51004c879540ca4a05b0a14cbd004c95fb2bdd6d6e7ba1773c27bfce2aaa152cc3ffe0237647d6820c0bc042432b2771ab0e61f12bc27ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
3f6ee48bf0063f3002a3f77262cf6de7

SHA1
d98848d8d0ba3958ad39699b901375252b39e9e2

SHA256
3bee1d39c91e1214232a44a293331f71a24d6b3920b2afd79b98cb611addaf39

SHA512
772dcb418210b8e5e71c45e30d06bc39f74adee0cf67122e91f0d47f26394e1cae62e24f1c190e00456873279c83d0a11fcd99e3ebaf990d54dbe846235f94f1

Download Submit