Analysis
-
max time kernel
89s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
06-11-2021 19:09
Behavioral task
behavioral1
Sample
=Aa, den Plads vilde jeg endda gjerne ha..pdf
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
=Aa, den Plads vilde jeg endda gjerne ha..pdf
Resource
win10-en-20211014
General
-
Target
=Aa, den Plads vilde jeg endda gjerne ha..pdf
-
Size
203KB
-
MD5
1584799acea73843db64cfd06f77883a
-
SHA1
b8d3076d484f97243689c8da4e337aaae033e804
-
SHA256
70b170ab9948ba03af09c2ee6bd6bf8a7f16f0f594a992c38d62346423fe915e
-
SHA512
04efdc881099c9c082f78c0af20671b346a89e1217f769fe9dcd585e7c8ff6d2ca19c423c9b811f7cb306c6c018af60095423ffb03aa7153e5f35d72e0dccd5f
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 784 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe 784 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 784 wrote to memory of 3640 784 AcroRd32.exe RdrCEF.exe PID 784 wrote to memory of 3640 784 AcroRd32.exe RdrCEF.exe PID 784 wrote to memory of 3640 784 AcroRd32.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1916 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe PID 3640 wrote to memory of 1288 3640 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\=Aa, den Plads vilde jeg endda gjerne ha..pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C4B10A2FCE85E078075C8ED1868F11E8 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=178502CE9AB96D7000B6A8B7829EAF6A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=178502CE9AB96D7000B6A8B7829EAF6A --renderer-client-id=2 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C913D17ABAE1FAD7C45FB93803502ECE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C913D17ABAE1FAD7C45FB93803502ECE --renderer-client-id=4 --mojo-platform-channel-handle=2228 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F2BD138F0F27B3BA8DB51537C9D698F --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=14470D31801E5A80BADBD326CADA3955 --mojo-platform-channel-handle=2592 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5FB408D65B43E4798F91A88BB11186F2 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1288-125-0x0000000001BA0000-0x0000000001BA1000-memory.dmpFilesize
4KB
-
memory/1288-124-0x00000000017D0000-0x00000000017D1000-memory.dmpFilesize
4KB
-
memory/1288-121-0x0000000001B8A000-0x0000000001B8B000-memory.dmpFilesize
4KB
-
memory/1288-120-0x0000000077672000-0x0000000077673000-memory.dmpFilesize
4KB
-
memory/1288-122-0x0000000000000000-mapping.dmp
-
memory/1556-137-0x0000000077672000-0x0000000077673000-memory.dmpFilesize
4KB
-
memory/1556-139-0x0000000000000000-mapping.dmp
-
memory/1556-138-0x0000000000B1C000-0x0000000000B1D000-memory.dmpFilesize
4KB
-
memory/1916-118-0x0000000000000000-mapping.dmp
-
memory/1916-119-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/1916-116-0x0000000077672000-0x0000000077673000-memory.dmpFilesize
4KB
-
memory/1916-117-0x0000000000E37000-0x0000000000E38000-memory.dmpFilesize
4KB
-
memory/2148-127-0x0000000077672000-0x0000000077673000-memory.dmpFilesize
4KB
-
memory/2148-128-0x0000000000B4F000-0x0000000000B50000-memory.dmpFilesize
4KB
-
memory/2148-129-0x0000000000000000-mapping.dmp
-
memory/2400-133-0x0000000077672000-0x0000000077673000-memory.dmpFilesize
4KB
-
memory/2400-135-0x0000000000000000-mapping.dmp
-
memory/2400-134-0x0000000000DC1000-0x0000000000DC2000-memory.dmpFilesize
4KB
-
memory/3260-141-0x0000000077672000-0x0000000077673000-memory.dmpFilesize
4KB
-
memory/3260-142-0x00000000017CA000-0x00000000017CB000-memory.dmpFilesize
4KB
-
memory/3260-143-0x0000000000000000-mapping.dmp
-
memory/3544-126-0x0000000000000000-mapping.dmp
-
memory/3640-115-0x0000000000000000-mapping.dmp