1969bd0656ed970799f89313c0988c206d5c727a39438ac936a1c0c8d0652de4

Analysis

max time kernel
133s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/ACH_Transfer.pdf
Size

2.3MB
MD5

1e608a2f86ebacd7ec9e8b93a37da0db
SHA1

443584ec6a6fb414e014a02d5c6b64857c9fda42
SHA256

6374463d063f3d52c198b9a78e2160321778fe6be451a7a133646e038c4cd7b2
SHA512

ded60ff3ea43a54621f2e5358b0c4eb05b5c96c10ddc19c2c093d83493c1a0d748df83954795a222a0a964ab127c83248374f4c3e29c8a723c6cd7636164425c
SSDEEP

49152:WvcNx86oTAFNzZI4vpNMdVQ/UVGLb+eZV1mPw656:bxQsNzZIc/Q3wL

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
400	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
400	AcroRd32.exe
400	AcroRd32.exe
400	AcroRd32.exe
400	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4088	400	AcroRd32.exe	85
PID 400 wrote to memory of 4088	400	AcroRd32.exe	85
PID 400 wrote to memory of 4088	400	AcroRd32.exe	85
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 3260	4088	RdrCEF.exe	88
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89
PID 4088 wrote to memory of 1892	4088	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BIBLE 2023\ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS\ACH_Transfer.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EC7F2F5F2B799250D016CBF6E1D5FC17 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3260
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C924DA75A89E6E4A453EBE34F74B1748 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C924DA75A89E6E4A453EBE34F74B1748 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CC42F31D29161AA1720840103C87F85D --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2836
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3FD227F77F8A65C054C7CF6164F2DCEE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3FD227F77F8A65C054C7CF6164F2DCEE --renderer-client-id=5 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CEC9F4F7A1F1712ECD2E2C7409195DC6 --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2556
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ED4A598399135E21C55F7EC9DBC03CBF --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
3bec195f936cb9d57be54b620a99b373

SHA1
6729dc5f01b56dc8e29a14c795dab4810620065e

SHA256
f92d07f3c3df1e4af970c3703f1db97a8bf9e0c4cb4794773008412d8776d630

SHA512
21406e9664cd20e8a44aee25cfff639731216a1ba32122f48b790afa831297e9fff1d043cd81d1e54350409468e2073498eefccd37258baf52628b669ad61d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
9dd0ef52aeaa1a5251480bd2087ea409

SHA1
f13485d0bf7349a1e266f04a408ddfdc40d4f70c

SHA256
ef7da71e1645dba693810e7c240a77d2bd9a070d8ddbc64c34d012adb095fa61

SHA512
a7183cf2f4b6879f7843db01f42be67043307675f18f4aa15626a36c33c2b88b62cb8fffc81d3833b1d5e35049f7ded637d2d662f721c738f2204378c9c1fa26

Download Submit