396d17e03ea7d2c2bb1388baa287ff43bf58d580123caf7bd40e5211c1c4341a

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024_07_01_Lilly_Art_ch_1.pdf
Size

245KB
MD5

3214401980ef50e9e9d5ff49f51a86c1
SHA1

d12dd6858385fecb56c597342fc209780fb9d91d
SHA256

396d17e03ea7d2c2bb1388baa287ff43bf58d580123caf7bd40e5211c1c4341a
SHA512

f7bfc88207d157732dc600aaa05a2fd314a7638932190e2e319e7fbf4a2766d7bb3112848520e388eadb8122bed760bc6dd2c9b2ba27a7141facab2fc7eb7201
SSDEEP

6144:dnM8D+rubaBj5oCsrpmvIG//Ax6lAF7hatGVpe8bikqTf:dnV+r4asCw8Qwc6Y7k4VfdqT

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1932	AcroRd32.exe
1932	AcroRd32.exe
1932	AcroRd32.exe
1932	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1516	1932	AcroRd32.exe	81
PID 1932 wrote to memory of 1516	1932	AcroRd32.exe	81
PID 1932 wrote to memory of 1516	1932	AcroRd32.exe	81
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 4320	1516	RdrCEF.exe	82
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83
PID 1516 wrote to memory of 3920	1516	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2024_07_01_Lilly_Art_ch_1.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5D9A667ECD14C44F5B4BC99B8A70C137 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4320
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=642EA16CEB41939E591C04C86A7CB99E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=642EA16CEB41939E591C04C86A7CB99E --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=287282E1DFA71A70C5F9199EE3FCFE8A --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3088
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7C8E0307B8EFA23FE545F7A912B8C139 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7C8E0307B8EFA23FE545F7A912B8C139 --renderer-client-id=5 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:748
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B2DA7FE205D085C94A25050A555DC96B --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3452
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=229683A6D221459596502EF2EF7734DA --mojo-platform-channel-handle=1908 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
e9d3f3a57db79c79ca6cbd0f0e7cb490

SHA1
075fdce5c2216c4375466cf346d77336d37702d6

SHA256
7b23c4156fef82fd19699a2d9a1c22c9748762dfef7f64b241768d23cd25d8d4

SHA512
f689629cdae00c1f2e34e7559726a8c69b831c121c9a0bbad9218c19ce01e419564d78af4211ff8072c64873b60603c5482c1d1abc2c942c28b1210d5a0fdb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ee162380f32e602084bb49cde80603c3

SHA1
4642c95fc9f0e1274d606683f97b46879c3bd907

SHA256
0339f63313bff48ea682e3c8eef6ac559f46bd5af15934723e875a3d242267df

SHA512
f3440e9e49a0273c26ee354d9d4779e97d150441469cbb154127bf9d6cbd85c9c8b6e7356effac8260c7f37b810f9a758acf4f649684a6899d90052eee11363d

Download Submit