Analysis
-
max time kernel
123s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
29-10-2021 19:10
Behavioral task
behavioral1
Sample
qnrwll94 argga.94 wknuwip94 u.paypsi94 .mvhwvjqcn94 .ftutag94 .qydvthga.94 cvovyyfm.94 qinaf.lhwl94.pdf
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
qnrwll94 argga.94 wknuwip94 u.paypsi94 .mvhwvjqcn94 .ftutag94 .qydvthga.94 cvovyyfm.94 qinaf.lhwl94.pdf
Resource
win10-en-20211014
General
-
Target
qnrwll94 argga.94 wknuwip94 u.paypsi94 .mvhwvjqcn94 .ftutag94 .qydvthga.94 cvovyyfm.94 qinaf.lhwl94.pdf
-
Size
162KB
-
MD5
5c291f61380e982c5f3f61f5b91f5712
-
SHA1
563bd6f5c7917816b0a7701dfbf5344838e50b66
-
SHA256
1017b9687ec81efa3529bfa007d7a43f424223398e701ed61ebf8a7422d49fea
-
SHA512
8539dd8235b44118656d7dde5bf8c27aff62a527c8943f9c74101913dd3acb451bc3bd3a2cb2c065645a0fa317585283a94fd192c1da5378195ff9ff75ce43bd
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AcroRd32.exepid process 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2644 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe 2644 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2644 wrote to memory of 1012 2644 AcroRd32.exe RdrCEF.exe PID 2644 wrote to memory of 1012 2644 AcroRd32.exe RdrCEF.exe PID 2644 wrote to memory of 1012 2644 AcroRd32.exe RdrCEF.exe PID 2644 wrote to memory of 1984 2644 AcroRd32.exe RdrCEF.exe PID 2644 wrote to memory of 1984 2644 AcroRd32.exe RdrCEF.exe PID 2644 wrote to memory of 1984 2644 AcroRd32.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1408 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe PID 1012 wrote to memory of 1464 1012 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\qnrwll94 argga.94 wknuwip94 u.paypsi94 .mvhwvjqcn94 .ftutag94 .qydvthga.94 cvovyyfm.94 qinaf.lhwl94.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B667F957D7421E9DC0DA466D24211FE4 --mojo-platform-channel-handle=1588 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FE3DA06DF9F342968EAFDAAF90F38C09 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FE3DA06DF9F342968EAFDAAF90F38C09 --renderer-client-id=2 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DA11DCF675BAC7CFA34CFC8BA54A3F66 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DA11DCF675BAC7CFA34CFC8BA54A3F66 --renderer-client-id=4 --mojo-platform-channel-handle=2068 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3FC3D290B15388FFEE0DC862674BE379 --mojo-platform-channel-handle=2464 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=60132BB7F9C58DEC83CDFE8573FF7BEB --mojo-platform-channel-handle=1844 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=22260392094B5092086A61BF0ABE1BE4 --mojo-platform-channel-handle=2016 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/352-132-0x0000000000000000-mapping.dmp
-
memory/352-131-0x000000000137B000-0x000000000137C000-memory.dmpFilesize
4KB
-
memory/352-130-0x0000000077D52000-0x0000000077D53000-memory.dmpFilesize
4KB
-
memory/1012-118-0x0000000000000000-mapping.dmp
-
memory/1408-123-0x0000000001360000-0x0000000001361000-memory.dmpFilesize
4KB
-
memory/1408-122-0x0000000000000000-mapping.dmp
-
memory/1408-121-0x000000000173D000-0x000000000173E000-memory.dmpFilesize
4KB
-
memory/1408-120-0x0000000077D52000-0x0000000077D53000-memory.dmpFilesize
4KB
-
memory/1464-129-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/1464-128-0x0000000001380000-0x0000000001381000-memory.dmpFilesize
4KB
-
memory/1464-126-0x0000000000000000-mapping.dmp
-
memory/1464-124-0x0000000077D52000-0x0000000077D53000-memory.dmpFilesize
4KB
-
memory/1464-125-0x0000000001738000-0x0000000001739000-memory.dmpFilesize
4KB
-
memory/1552-141-0x000000000137E000-0x000000000137F000-memory.dmpFilesize
4KB
-
memory/1552-140-0x0000000077D52000-0x0000000077D53000-memory.dmpFilesize
4KB
-
memory/1552-142-0x0000000000000000-mapping.dmp
-
memory/1948-145-0x00000000009ED000-0x00000000009EE000-memory.dmpFilesize
4KB
-
memory/1948-144-0x0000000077D52000-0x0000000077D53000-memory.dmpFilesize
4KB
-
memory/1948-146-0x0000000000000000-mapping.dmp
-
memory/1984-119-0x0000000000000000-mapping.dmp
-
memory/3184-136-0x0000000077D52000-0x0000000077D53000-memory.dmpFilesize
4KB
-
memory/3184-137-0x000000000138E000-0x000000000138F000-memory.dmpFilesize
4KB
-
memory/3184-138-0x0000000000000000-mapping.dmp