Analysis
-
max time kernel
114s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-10-2021 19:10
Behavioral task
behavioral1
Sample
biuzp.pwys382 hd.bnlpctw382 .ghx382 q.yznyjwsw382 gm.mzg382 pfsjb382 x.aq382 semd382 f.q.pdf
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
biuzp.pwys382 hd.bnlpctw382 .ghx382 q.yznyjwsw382 gm.mzg382 pfsjb382 x.aq382 semd382 f.q.pdf
Resource
win10-en-20210920
General
-
Target
biuzp.pwys382 hd.bnlpctw382 .ghx382 q.yznyjwsw382 gm.mzg382 pfsjb382 x.aq382 semd382 f.q.pdf
-
Size
166KB
-
MD5
7cc8c1e149e6c6377798cc68430791b7
-
SHA1
a0f82ccdbd092f2dcca0b9cf35baac87d448318c
-
SHA256
5de9c0b2bcaa84377c7c8179306c703024d4d2794fc21d0a6b57e06f86e7ad8d
-
SHA512
6f66c2ba2621a456d848281f50d57306663bf45306c55e1e4ecdb830c6257349ca9b5b5fc2d3cc4768e0b66066aadcd076de1eabc8f5c8bd494c5cef060ace58
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AcroRd32.exepid process 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 4328 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe 4328 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 4328 wrote to memory of 4036 4328 AcroRd32.exe RdrCEF.exe PID 4328 wrote to memory of 4036 4328 AcroRd32.exe RdrCEF.exe PID 4328 wrote to memory of 4036 4328 AcroRd32.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4484 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe PID 4036 wrote to memory of 4648 4036 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\biuzp.pwys382 hd.bnlpctw382 .ghx382 q.yznyjwsw382 gm.mzg382 pfsjb382 x.aq382 semd382 f.q.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7979E58518F34F6F2C2A64A927291E16 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7979E58518F34F6F2C2A64A927291E16 --renderer-client-id=2 --mojo-platform-channel-handle=1632 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A1F60AB011F347F2262B8AF0A5A0E92 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FD53CF07F638ABD64975F98B1648E799 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FD53CF07F638ABD64975F98B1648E799 --renderer-client-id=4 --mojo-platform-channel-handle=2096 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C20995CFB957DA8BDB16CA591079FDE2 --mojo-platform-channel-handle=1972 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8868A1AB0347216240143A338C21BA13 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=948E7CA929366E76B62CB6C0C217ADBE --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-133-0x0000000001977000-0x0000000001978000-memory.dmpFilesize
4KB
-
memory/1104-132-0x0000000077D32000-0x0000000077D33000-memory.dmpFilesize
4KB
-
memory/1104-134-0x0000000000000000-mapping.dmp
-
memory/1812-126-0x0000000077D32000-0x0000000077D33000-memory.dmpFilesize
4KB
-
memory/1812-127-0x000000000197D000-0x000000000197E000-memory.dmpFilesize
4KB
-
memory/1812-128-0x0000000000000000-mapping.dmp
-
memory/2668-136-0x0000000077D32000-0x0000000077D33000-memory.dmpFilesize
4KB
-
memory/2668-137-0x00000000015BA000-0x00000000015BB000-memory.dmpFilesize
4KB
-
memory/2668-138-0x0000000000000000-mapping.dmp
-
memory/4036-115-0x0000000000000000-mapping.dmp
-
memory/4208-142-0x0000000000000000-mapping.dmp
-
memory/4208-140-0x0000000077D32000-0x0000000077D33000-memory.dmpFilesize
4KB
-
memory/4208-141-0x0000000000B68000-0x0000000000B69000-memory.dmpFilesize
4KB
-
memory/4484-118-0x0000000000000000-mapping.dmp
-
memory/4484-117-0x0000000001975000-0x0000000001976000-memory.dmpFilesize
4KB
-
memory/4484-116-0x0000000077D32000-0x0000000077D33000-memory.dmpFilesize
4KB
-
memory/4484-122-0x00000000015C0000-0x00000000015C1000-memory.dmpFilesize
4KB
-
memory/4484-120-0x00000000015A0000-0x00000000015A1000-memory.dmpFilesize
4KB
-
memory/4484-124-0x0000000001990000-0x0000000001991000-memory.dmpFilesize
4KB
-
memory/4648-121-0x00000000015B2000-0x00000000015B3000-memory.dmpFilesize
4KB
-
memory/4648-119-0x0000000077D32000-0x0000000077D33000-memory.dmpFilesize
4KB
-
memory/4648-123-0x0000000000000000-mapping.dmp