33a600ff735bd5ca962a81f726ed3184e87f31afb0c27edfa39bbf459329b48a

Analysis

max time kernel
7s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33a600ff735bd5ca962a81f726ed3184e87f31afb0c27edfa39bbf459329b48a_NeikiAnalytics.pdf
Size

80KB
MD5

2a762b72aaec5d3582d08d7c147e4f20
SHA1

99dec2a966aa38cb8b2678c36c358f19b1f040f2
SHA256

33a600ff735bd5ca962a81f726ed3184e87f31afb0c27edfa39bbf459329b48a
SHA512

3ef6f372bcc273cc209e3a2dfbe7d5ae60e89e032a279d6aec107824a4b7098e28ce1f1756d90233cb51f113238ff4c924112c77efcf62cec6163dc9bc81a122
SSDEEP

1536:OGJcrUl0LpMZo61dxq8/Osz0dukuGo9s3AsNplCPNZqOb:JM1SoMe8dz0s+oqAyMVZH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

AcroRd32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3568 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3568 AcroRd32.exe
3568 AcroRd32.exe
3568 AcroRd32.exe
3568 AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

pid	process
3568	AcroRd32.exe

pid	process
3568	AcroRd32.exe
3568	AcroRd32.exe
3568	AcroRd32.exe
3568	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3568 wrote to memory of 4852	3568	AcroRd32.exe	RdrCEF.exe
PID 3568 wrote to memory of 4852	3568	AcroRd32.exe	RdrCEF.exe
PID 3568 wrote to memory of 4852	3568	AcroRd32.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4756	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe
PID 4852 wrote to memory of 4868	4852	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\33a600ff735bd5ca962a81f726ed3184e87f31afb0c27edfa39bbf459329b48a_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4852

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CAF2F2CA22C18387A76AAAD379D0BA82 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4756

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C92F98EC8FD70EB42A8747A78B393A21 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C92F98EC8FD70EB42A8747A78B393A21 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4868

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=42960E43F2FBD3EDCDCDAD32C356BBA5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=42960E43F2FBD3EDCDCDAD32C356BBA5 --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3340

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E507DEA491416317E9CE45D62405E099 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1180

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5FF3ABC2E00D34955947AE2F19E15BEA --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=30A8BD8ADBEA82EF9DF457053A1B523C --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
6fe9d7a81e5bc2c1212e3600627367d1

SHA1
5555ebe66ff4830719f4941f740fe2b1c4e7b43c

SHA256
6f37c7d91aef974df1ad1cbdf2a7567de2059e7890de8e475493d135bbcc5420

SHA512
00b8d856cb7c4262d193c22b4a60f12eec2a3acdf682995571e9de50d4861e281b8bc79de1000206287c995d595deded02a87f29f77eb0704c2282c78c1f2f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
4e18010c2e57cb33a5d0cde3fb4eda68

SHA1
cd643093734653519b59584fd267961a4b545330

SHA256
e3093576928da0055944127b09ca83d5ee404be384d2aa8fca2229f0bf5b6725

SHA512
cce62e3a3c098ea92ae435c41e920256f028360bd8256f2a8605ee6af87d0dc38649c0914ae0777f40d105c1bee19173a411175ac5994fad4755745295500c13

Download Submit