Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
01-11-2021 03:09
Behavioral task
behavioral1
Sample
88910*86p 3496*2030p 2*8454p 236*4p 3053918p 64*6917p 77*689p 1549760*81p 8782p 54.pdf
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
88910*86p 3496*2030p 2*8454p 236*4p 3053918p 64*6917p 77*689p 1549760*81p 8782p 54.pdf
Resource
win10-en-20211014
General
-
Target
88910*86p 3496*2030p 2*8454p 236*4p 3053918p 64*6917p 77*689p 1549760*81p 8782p 54.pdf
-
Size
190KB
-
MD5
a78c12c0e5a02ed6541b468345c744f2
-
SHA1
bd0d41e27269367a7398864cfd5a515a6ac101d5
-
SHA256
e536cf3d0c9db06af563df82e4906027adbe61e07c27c972e0e2b1a4debe8441
-
SHA512
7c58d00b92bbba6fb2628c4d1b3faa8d3e0e747174bd19d2b3cc2f0935402c8aca3d402680036b725739dec4ac38fb46015ac0086b86f159408c5093f3105df1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AcroRd32.exepid process 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3128 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe 3128 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3128 wrote to memory of 1044 3128 AcroRd32.exe RdrCEF.exe PID 3128 wrote to memory of 1044 3128 AcroRd32.exe RdrCEF.exe PID 3128 wrote to memory of 1044 3128 AcroRd32.exe RdrCEF.exe PID 3128 wrote to memory of 2744 3128 AcroRd32.exe RdrCEF.exe PID 3128 wrote to memory of 2744 3128 AcroRd32.exe RdrCEF.exe PID 3128 wrote to memory of 2744 3128 AcroRd32.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 1068 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe PID 1044 wrote to memory of 2428 1044 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\88910_86p 3496_2030p 2_8454p 236_4p 3053918p 64_6917p 77_689p 1549760_81p 8782p 54.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E205D2F04C601B102BF6EBD73DD9EA39 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E205D2F04C601B102BF6EBD73DD9EA39 --renderer-client-id=2 --mojo-platform-channel-handle=1608 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=21243EA2F848CA30969755EC8E893FD0 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3287F53393F3400780F971B41C98692A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3287F53393F3400780F971B41C98692A --renderer-client-id=4 --mojo-platform-channel-handle=2112 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5BF12C0443F0DE6E7E8032F6B304B01C --mojo-platform-channel-handle=2592 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C14D204E72122FFB9955B5BFE946D51A --mojo-platform-channel-handle=2064 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=545000E49C7087985A1BC101F51CF320 --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1044-118-0x0000000000000000-mapping.dmp
-
memory/1068-128-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/1068-126-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/1068-120-0x0000000077532000-0x0000000077533000-memory.dmpFilesize
4KB
-
memory/1068-122-0x0000000000000000-mapping.dmp
-
memory/1068-121-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/1068-124-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/1716-138-0x0000000000000000-mapping.dmp
-
memory/1716-137-0x0000000000E22000-0x0000000000E23000-memory.dmpFilesize
4KB
-
memory/1716-136-0x0000000077532000-0x0000000077533000-memory.dmpFilesize
4KB
-
memory/2216-140-0x0000000077532000-0x0000000077533000-memory.dmpFilesize
4KB
-
memory/2216-141-0x0000000000FD2000-0x0000000000FD3000-memory.dmpFilesize
4KB
-
memory/2216-142-0x0000000000000000-mapping.dmp
-
memory/2428-123-0x0000000077532000-0x0000000077533000-memory.dmpFilesize
4KB
-
memory/2428-127-0x0000000000000000-mapping.dmp
-
memory/2428-125-0x0000000000B57000-0x0000000000B58000-memory.dmpFilesize
4KB
-
memory/2744-119-0x0000000000000000-mapping.dmp
-
memory/3856-146-0x0000000000000000-mapping.dmp
-
memory/3856-144-0x0000000077532000-0x0000000077533000-memory.dmpFilesize
4KB
-
memory/3856-145-0x0000000000F62000-0x0000000000F63000-memory.dmpFilesize
4KB
-
memory/3976-132-0x0000000000000000-mapping.dmp
-
memory/3976-131-0x0000000000FF2000-0x0000000000FF3000-memory.dmpFilesize
4KB
-
memory/3976-130-0x0000000077532000-0x0000000077533000-memory.dmpFilesize
4KB