ba882dd2c9b0849a08acf699609f7c1d5e085aa970ca109ffb1ffd7bb8e41465

Analysis

max time kernel
94s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba882dd2c9b0849a08acf699609f7c1d5e085aa970ca109ffb1ffd7bb8e41465_NeikiAnalytics.pdf
Size

416KB
MD5

4311d68471c588cc980dbf08a2416610
SHA1

64f16ffc377cb68b102eace3739bd2a510d4da49
SHA256

ba882dd2c9b0849a08acf699609f7c1d5e085aa970ca109ffb1ffd7bb8e41465
SHA512

f15387629bac6dba523d434e12d191af91bfae86b65384d777133140fa16c6b04400640a70736d597b3290a0c286d2dceeaa6a3962fc0cd9b045be98f1204afd
SSDEEP

12288:RrnFtVGNWawRMk2sR/wFW+C+m6t1TMcW+:RrnFtzCWhwF6+9zTQ+

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

AcroRd32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4124 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

4124 AcroRd32.exe
4124 AcroRd32.exe
4124 AcroRd32.exe
4124 AcroRd32.exe
4124 AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

pid	process
4124	AcroRd32.exe

pid	process
4124	AcroRd32.exe
4124	AcroRd32.exe
4124	AcroRd32.exe
4124	AcroRd32.exe
4124	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4124 wrote to memory of 4908	4124	AcroRd32.exe	RdrCEF.exe
PID 4124 wrote to memory of 4908	4124	AcroRd32.exe	RdrCEF.exe
PID 4124 wrote to memory of 4908	4124	AcroRd32.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3448	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 868	4908	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ba882dd2c9b0849a08acf699609f7c1d5e085aa970ca109ffb1ffd7bb8e41465_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1432DF35C07C7C00055F23D9D8696E14 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3448

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9273E8FD6D8247303922EF35FDC95CDD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9273E8FD6D8247303922EF35FDC95CDD --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:868

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=75DBDD73EABC43151732D558625588A7 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4940

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F438D35885175AE1681574BB8F895E50 --mojo-platform-channel-handle=1900 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2264

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F1B3C3B050F00E26F678B8D2822846BF --mojo-platform-channel-handle=2428 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3792

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=569D20074C063870E9E247EE995A928E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=569D20074C063870E9E247EE995A928E --renderer-client-id=7 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
744eeb03e35c3c47b66efac59597120c

SHA1
c7c0c99d4a11df7298a007382df69a25bf25f443

SHA256
f43a6e78b894dbffd8cfd93095bd9c0952f4c82131e2557514b3fef36bfe83f8

SHA512
ec6d33bfd1fd306aafd3760d1bda67718853dc909c53e17085f03debb014d9f871481a3323df140143494a7c6334b3a49e3481fd04e20d07e05aa88483fbeebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
667f4b52e4223eecd1d468cb18ebbf68

SHA1
1768037fbc23e217de964dc87f05b7a1c1137dbf

SHA256
32befccf5cbca3728d7f43a2938992bcd8c5c028aa903b42d0d141718e8c833b

SHA512
a97574a45a375e55b0ab8e93b91424bd948a1d0e0f1950188160712fd063cb7f9f87af1aae3585061addf565987a2e2815b12567bfab5977d298e91af8b6bb00

Download Submit