1b266c2b9a5a87b0759490c83b940f2b22e18ec33efc965c71cb8c4bd29e7044

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CFEMAIL.CUENTA.so0qVDHwwe.pdf
Size

44KB
MD5

7755a1f157d82718563fade88d3d8580
SHA1

5f17b8ade45ee9db1f527835e356b359de4a2d6a
SHA256

1b266c2b9a5a87b0759490c83b940f2b22e18ec33efc965c71cb8c4bd29e7044
SHA512

be8a6624bd079c3095f49502c4e7c6eeda8efb1259b1e018b6828e7965355e16842587b2a7d19044329bcf923c3895f06b9c1b50fac1676775937662d86bcf9e
SSDEEP

768:Opbv9uicidn0C9YESDWr6i8TY6kNa5VoSmARj8rdDCQ/z/t5aUs:Op5uCSdA6i886kNagjARj8huQL/m9

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe
3544	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1172	3544	AcroRd32.exe	81
PID 3544 wrote to memory of 1172	3544	AcroRd32.exe	81
PID 3544 wrote to memory of 1172	3544	AcroRd32.exe	81
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 2648	1172	RdrCEF.exe	82
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83
PID 1172 wrote to memory of 5108	1172	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CFEMAIL.CUENTA.so0qVDHwwe.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0CAF86E73754D1A6A6C3D3E46411521B --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2648
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=215B81334CB88121CFD55153759191EF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=215B81334CB88121CFD55153759191EF --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=49C923EAAD3D0058028F29B934F0F5BA --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3880
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=47F2948F4A8A35A35E4F300A081B11D5 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4548
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4BC849EDC1C827F981D56559C950D9F5 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
2290e003dcc6b0b2fe9b402b9d002c93

SHA1
f0ad869f2b7ae733aecba655b697b7f29f32650c

SHA256
2c90870ee81045fe0b0b75e6703ab4c66a4699ead4c1cd3a7df3d689cf62bfda

SHA512
7f030af1af1e2b810ee47f13bd655914c91a9b78691cfe93aa46c30a5ef649a72f7b1985d499fccac2d4ddb697b15f496711500c65faf7e42e572c12891a33bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
8cd1c382cdeafaff1c62cee3c4ee0e56

SHA1
914d3cda5bee1481e5870d02940ab4a600586a6d

SHA256
89978b3a21fea18edb7e401d2c947742e09b3de478abd82dae634bfa7daa3929

SHA512
bf9cfbc598397b8dd883ada7e64aa69e1a51d56ab8a3ede0ce6d8b5d2e5f380409318eef55165f335dfc959ca430d8c12e745b6f8a884aacd3a662ade01b2e5f

Download Submit