38831a3ed855da278c6908da4ebfb05799f7b4c7d6047e3cf8c33957fa54c305

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C30909-0084_88711705_RL4A9W_005586-PDFTICKET.pdf
Size

870KB
MD5

3f4533078fcebacffac2f28a6ab9bdd4
SHA1

8ef8cd3503e58a4b7ed497132c15fd017ded2d89
SHA256

38831a3ed855da278c6908da4ebfb05799f7b4c7d6047e3cf8c33957fa54c305
SHA512

2512dd9c2abf3c45e9b5c750fad69fd7db30410e75bedb284ea042a5742d780136118b1d2546fa3d37b859f56967ed7cae03ae74747cd31b067dcbca66fb6786
SSDEEP

12288:GXs/PWzabVys86EZa2gEafDdwD5gt37hcZgqXJg2d0fFjHPXC9xwYWxKO:GOvQs865nf0yDcZYO0fF7PXC9qF

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

AcroRd32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1296 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1296 AcroRd32.exe
1296 AcroRd32.exe
1296 AcroRd32.exe
1296 AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

pid	process
1296	AcroRd32.exe

pid	process
1296	AcroRd32.exe
1296	AcroRd32.exe
1296	AcroRd32.exe
1296	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1296 wrote to memory of 1228	1296	AcroRd32.exe	RdrCEF.exe
PID 1296 wrote to memory of 1228	1296	AcroRd32.exe	RdrCEF.exe
PID 1296 wrote to memory of 1228	1296	AcroRd32.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 4020	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe
PID 1228 wrote to memory of 3212	1228	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\C30909-0084_88711705_RL4A9W_005586-PDFTICKET.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4A8612CA64BED6752084D26102578075 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1C83CC53659565A96F7F0E3FDCA7DEB1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1C83CC53659565A96F7F0E3FDCA7DEB1 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3212

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=033D7E6CA55F1A070FE28D5E4DD46F28 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3688

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1911AB8ECE42279630CCB14360AE3E6C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1911AB8ECE42279630CCB14360AE3E6C --renderer-client-id=5 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4212

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D13F89FB0AA612F721A36513A579301E --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2172

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A45D9870BF62E43A65484B7DF7D0E0B8 --mojo-platform-channel-handle=2768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
b58bbf50c2ee1cc2b8f7ae33d026b335

SHA1
2371a7bfacc74291b8e90ae10514ee9977f85256

SHA256
1bcfd40e431e1a3f971b4325a7786d37cf422d76dd4817f9e3e6c382fbbe5eef

SHA512
973ec98fc744cc72615a02f5f3418b1fb6094766f893512719039a6e0851ca12d6aa8d55584926b2f3b6e2589378e902097239b23df5f922f3088c5860f9e401

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
a2af9e449b430fa64d6a2876dc340c8f

SHA1
bb03d34a06fb9a2ab488a6e587714a16c1a98324

SHA256
ba893daf903ace9c489095b979b860e98662722a6d585e2b351e81f28cb65be1

SHA512
50f2d97bdd1cebbd0cc82edf2062df27b620d18c5d2bb31f2eaffce012843deb8f325e4cc6ec989545f20c428cb78af58e61f46232f2f06bf6073de0abcd1015

Download Submit