1969bd0656ed970799f89313c0988c206d5c727a39438ac936a1c0c8d0652de4

Analysis

max time kernel
136s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/LOADING CASHAPP USING AN HUNTINGTON BANK LOG.pdf
Size

151KB
MD5

bccdd509e79cd78790523f9423f978b8
SHA1

f372557cb84d9535846d3a8ee5c0f9eff3ba06f3
SHA256

594bdede4cb6f96f42590d11a8ddef07e695a79b9e80454af8e2c89eeb68e6b4
SHA512

e7a37765b1e1ad44de2c2e7ae46ca4f3416774a0f988520e5a8b0eb10f5d95120cc971e1c1bcb924707d3328f30596861d0636a875584f6e6ece056fecbc5688
SSDEEP

3072:trbNbfh2t9bVFBU/+mMT3TmEHTJkhfRnGN+lk9f2hQ9uU:tvN7h2t9zB/T3TZ2h5nGka9ebU

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4036	2072	AcroRd32.exe	85
PID 2072 wrote to memory of 4036	2072	AcroRd32.exe	85
PID 2072 wrote to memory of 4036	2072	AcroRd32.exe	85
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 2836	4036	RdrCEF.exe	86
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87
PID 4036 wrote to memory of 3000	4036	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BIBLE 2023\ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS\LOADING CASHAPP USING AN HUNTINGTON BANK LOG.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D6C3EC8698C41E0B3319C384D5119323 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2836
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B553FC9B0749473624EB42E503420B32 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B553FC9B0749473624EB42E503420B32 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1FA68D37AEA329E642CE94F530C2328C --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1860
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8E17E4D90D77B0B924CFB47D3292DE3C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8E17E4D90D77B0B924CFB47D3292DE3C --renderer-client-id=5 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A25CC65661F2B6140F43CBB16A21F3DD --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1756
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=089FFA6C0AD2C8B8E5C389BB25E1573D --mojo-platform-channel-handle=2860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ea436d9c4e51159e83ee632f9f759e75

SHA1
5bcd238c50c1793b1ad2a57f4a137b5c2db20daf

SHA256
407b954bb567541bbb02c14dcf2a773b856a2264df72f56f9e9c9e8261d9cb55

SHA512
c37dc6fd157ba1d564e20d194caf3b794234837a0037f9dd9c14cd5d188be58fd0e7f989f117fd9a600c96904675f8e29218d858665d396db953da6387a20a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
87df66851f78bf3a1b59c5612c94a2a8

SHA1
91e797db74b81e04b8073641354d4148793bf420

SHA256
9117c4304b3ca0bb653ef72c7c3c6446d05ea363b6b72ed7e712218dd2f10163

SHA512
f656a3dc2ea1c69de0016d5a65d6bb90911a7ef3bb4bebe972bbdc36f689faeae025164cb9a6a5ce2fccdc3ea9be3239364066bb5c859bfcbc71c9cc2349d043

Download Submit