50a36720d5564eca164a081bd9ddac7b3e58fbc176aafe1f2995f562316d8bc4

General

Target
BRIQUEROUGE_AI_REUSSITEEDUCATIVE_20260717.pdf
Size 345KB
Sample260730-w9rt9sysas
SHA256 50a36720d5564eca164a081bd9ddac7b3e58fbc176aafe1f2995f562316d8bc4
MD5 04db2c5ba43fbdc0d267b1dd2f19b9e4
SHA1 844fa65cf73b0ba96c51fdc100ae96cefd7a5ecc
SHA512 61d93b9cadeeff59d461929ac95740d1b73a6a4b816f5eb5ef4fe51aa125b4296b9a040626ec2722203444eb95daf494a6d248f6f84fcdfad1780c89abbe81b6
SSDEEP 6144:nE7J77FyZtYzRHjnaXWmvgRvirn/PWKaMItW:EN7EiB2x6+OoItW
TLSH
T1F074AD70A04D8CDDFC4FD84DD9B83919896DB6036BCE3881701ECB46F311A896BAA5D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4344	AcroRd32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 3844	4344	AcroRd32.exe	86
PID 3844 wrote to memory of 2296	3844	AdobeCollabSync.exe	87
PID 2296 wrote to memory of 5020	2296	AdobeCollabSync.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BRIQUEROUGE_AI_REUSSITEEDUCATIVE_20260717.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3844
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 56bb9e00e2545b7ae8516391fc6d5c484bfd9a7d552ac491935370a0410f75d4
MD5 fe51b13fc75c7c414f7ddcf62576cbae
SHA1 76d188716e674d8755bbf458916fc086e90af1d4
SHA512 38716ec97f25f55668c241de8b8fad5644fbd5fe293992cd22dc56b637c4a68728fd780c4c5ba3659cf00d8f51f8c2a4f040055a9f0cd0525b2c612f2045e01f
SSDEEP 192:K+oGsTzoU27NTaUxmGX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNhX44UNlNaN
TLSH
T13F930F0F3556F261C5A896B4810084F3119EBF1BE7E6F1A392B2CD3F16F9643102DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 caa661b0a0d11a1f6ef2f961c31dc47ac5c14638973341fd021aab146f17cb85
MD5 83eac37cdb03b16d320834b9b2cdae50
SHA1 62943e59217dbdd7e950442ad0fa7577c028f5e9
SHA512 82fca1ffdea0020e2e538a4444ef419e58af55d3714515d8f0651486dd6ea44dfad2ea2d0de5618c768b383ab972b6c900eae136cfd7cfdbbce3bed8b8adb2e7
SSDEEP 192:a+oGsTzoU27NTaUxmG8HcdX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGW:aklNP8AX44UNlNaN
TLSH
T105930E0F2556F261C5A8A6B4814084F3119EBF1BE3E6F1A392B2CD3F16F9743112DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 4.3MB
SHA256 ed7d2fc2c84e03a3b7805b2d7baafae7b5db47bb1cc513d31ee5953453292abb
MD5 afee19ad5dfb509155ae17143c2fc5fc
SHA1 c7577c1d72933d0c817501041b4cc4fe1db14b57
SHA512 6a5e5ef76f59f26daaae41e28cd718e71f2eadaaf7f95bb600318b8dd770f3a38ad931778035bc8c5ebc97098456a190769952543c5931986489629f57e65685
SSDEEP 98304:N7cvkxdmiophbqm19q7Z80v9sJqu0wdr/dl6HGdRwfCJ7D7GA261fzITbjFdmF+:JcMfOphbqp7Z8i920wdLdl6mdTD7GA2h
TLSH
T1982633D8EE0B18F8CAB574A4845EB2CD82AA37076ED17003B74E998427167F1F5C5EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
TLSH
T18652B7E55E67BC99D827C649CB3430965AF250A703981E20928D6BD43EE789F3B40B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 6.4MB
SHA256 69d8e6484ffeeaa9b1ec6bb8707cdb15fe9cc4e854d1c7a40282c8772f53e1cc
MD5 ac80456395578e672c2a270d06469148
SHA1 eb91b84732599c333a1274904f39766f08bcac5c
SHA512 68416678d6f235d88d8c111d01a51a4565433eb0c642252e37a2285372dfd66c083bd95e80b4d95e9ea385ff203f6842763c1e87decf4ca76daeea4a10839204
SSDEEP 24576:67GBIIYsDBY2kNIe8o5UUvZ62BvqmN1qj+sgn80qsMbFmx8Az2DgpN3BB026c6gF:c
TLSH
T1CA66FAE48A6BECC5D817E188CBB875F756B2317703A40D20479D36D02F9698B3B44A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads