1969bd0656ed970799f89313c0988c206d5c727a39438ac936a1c0c8d0652de4

Analysis

max time kernel
136s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/LOADING CASHAPP USING AN HUNTINGTON BANK LOG.pdf
Size 151KB
Sample240703-29fd5ashle
SHA256 594bdede4cb6f96f42590d11a8ddef07e695a79b9e80454af8e2c89eeb68e6b4
MD5 bccdd509e79cd78790523f9423f978b8
SHA1 f372557cb84d9535846d3a8ee5c0f9eff3ba06f3
SHA512 e7a37765b1e1ad44de2c2e7ae46ca4f3416774a0f988520e5a8b0eb10f5d95120cc971e1c1bcb924707d3328f30596861d0636a875584f6e6ece056fecbc5688
SSDEEP 3072:trbNbfh2t9bVFBU/+mMT3TmEHTJkhfRnGN+lk9f2hQ9uU:tvN7h2t9zB/T3TZ2h5nGka9ebU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4036	2072	AcroRd32.exe	85
PID 2072 wrote to memory of 4036	2072	AcroRd32.exe	85
PID 2072 wrote to memory of 4036	2072	AcroRd32.exe	85
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BIBLE 2023\ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS\LOADING CASHAPP USING AN HUNTINGTON BANK LOG.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D6C3EC8698C41E0B3319C384D5119323 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2836
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B553FC9B0749473624EB42E503420B32 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B553FC9B0749473624EB42E503420B32 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1FA68D37AEA329E642CE94F530C2328C --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1860
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8E17E4D90D77B0B924CFB47D3292DE3C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8E17E4D90D77B0B924CFB47D3292DE3C --renderer-client-id=5 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A25CC65661F2B6140F43CBB16A21F3DD --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1756
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=089FFA6C0AD2C8B8E5C389BB25E1573D --mojo-platform-channel-handle=2860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 407b954bb567541bbb02c14dcf2a773b856a2264df72f56f9e9c9e8261d9cb55
MD5 ea436d9c4e51159e83ee632f9f759e75
SHA1 5bcd238c50c1793b1ad2a57f4a137b5c2db20daf
SHA512 c37dc6fd157ba1d564e20d194caf3b794234837a0037f9dd9c14cd5d188be58fd0e7f989f117fd9a600c96904675f8e29218d858665d396db953da6387a20a3d
SSDEEP 384:yeLdThPatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:ja+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download