182ac7684e6db4bf5cf789659326d64f54476f57f1f35ee523439864396b1caf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

182ac7684e6db4bf5cf789659326d64f54476f57f1f35ee523439864396b1caf_NeikiAnalytics.pdf
Size

90KB
MD5

3e0b4b2a1fb83d62ef807fe58e50e8b0
SHA1

434c51df7c3c6e6e17284ab27ee2be38019b323c
SHA256

182ac7684e6db4bf5cf789659326d64f54476f57f1f35ee523439864396b1caf
SHA512

6b4edc51106178ed2e3e436678fdab04bed092601793c12dd4203f73c019beaa9a87702556c4650738ea2d861b47b3f68dce52eb10c340a2112f5e3f9c4e49c4
SSDEEP

1536:l05e0JcqcJjSQ4KfRh8nSm7rmTyQF5cB6PtcKZ8TCDxi7CypHur1zwG1G9ZF:lQeOcJGORh8SrTyQFiacqw67oHi1zwGc

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

AcroRd32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3380 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

3380 AcroRd32.exe
3380 AcroRd32.exe
3380 AcroRd32.exe
3380 AcroRd32.exe
3380 AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

pid	process
3380	AcroRd32.exe

pid	process
3380	AcroRd32.exe
3380	AcroRd32.exe
3380	AcroRd32.exe
3380	AcroRd32.exe
3380	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3380 wrote to memory of 4028	3380	AcroRd32.exe	RdrCEF.exe
PID 3380 wrote to memory of 4028	3380	AcroRd32.exe	RdrCEF.exe
PID 3380 wrote to memory of 4028	3380	AcroRd32.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 1580	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe
PID 4028 wrote to memory of 4992	4028	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\182ac7684e6db4bf5cf789659326d64f54476f57f1f35ee523439864396b1caf_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4028

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C407AAEC374B7107A3E1346B5066D68B --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1580

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4E8D151E51D91664BE28B41AE8CA3C73 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4E8D151E51D91664BE28B41AE8CA3C73 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4992

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DEAA1ABF92A3C3F0140E013B321C2D1B --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3288

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AC8EA3C2E2C1637FE38336628CB13494 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=989C04D0C8EA2B89CA10B50612A20AA7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=989C04D0C8EA2B89CA10B50612A20AA7 --renderer-client-id=6 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=06E40F0EB3D109E6E69B44337DDD4D08 --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
5edcfeb9e079b6240bca5b0ed4e8121b

SHA1
2bceaa52c53ccf7b2989aabd3c8080bc000806cc

SHA256
a0d7454ece6370f3284effbd1d4f484b4e73366b7221714b31dbb193292d811c

SHA512
c1310b8a6a822b44866f279ec1303f2b497d530146063774a23cb20c0b5e39b1fe6a3f3398a2b775391c596f17259143e19ead5938f21bc82425eaed6ebe2661

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
d4ef068bcc81ca7e294ad4943d4a70c7

SHA1
cc911cb65c569796c37a9595c3b73fa52d1d7303

SHA256
edd707218b4cda842e8675e6aff25bb84ed030d7b3e7ee82c1dea43607f21274

SHA512
f9d54d367612e4d3f986a8bd7f588695bef2038937a8bdc50af7254a54669304b953e8d9539f9e76062b369a415bc0b6d52188d61024584de0c5c9303037865d

Download Submit