Analysis
-
max time kernel
179s -
max time network
206s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:22
Behavioral task
behavioral1
Sample
a7358bb72d70cb4e90011f26b15ede41af271e63fe584635d8b638ec6e7babda.pdf
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a7358bb72d70cb4e90011f26b15ede41af271e63fe584635d8b638ec6e7babda.pdf
Resource
win10-en-20211208
General
-
Target
a7358bb72d70cb4e90011f26b15ede41af271e63fe584635d8b638ec6e7babda.pdf
-
Size
67KB
-
MD5
290400014dd47271d6ed315d488f4b62
-
SHA1
70015609f797da3bbcacd2dcf6b0c6eca994fb21
-
SHA256
a7358bb72d70cb4e90011f26b15ede41af271e63fe584635d8b638ec6e7babda
-
SHA512
fc795c0325987bf7f3c5a6f0429dfc69be7e8e4177dd73b8b02d9d83cb01e3340b153bc872c1ca0197957c8ab27519e514a0974e911f3c39db1c7e8e08236aec
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3580 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe 3580 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3580 wrote to memory of 1644 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 1644 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 1644 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 1800 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 1800 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 1800 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 2216 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 2216 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 2216 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 712 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 712 3580 AcroRd32.exe RdrCEF.exe PID 3580 wrote to memory of 712 3580 AcroRd32.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 3168 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe PID 2216 wrote to memory of 1408 2216 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a7358bb72d70cb4e90011f26b15ede41af271e63fe584635d8b638ec6e7babda.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=274809F6BF3B5BFCAAB27900DCEBCA07 --mojo-platform-channel-handle=1644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=255B4F993B89601FA784860F2750EF09 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=255B4F993B89601FA784860F2750EF09 --renderer-client-id=2 --mojo-platform-channel-handle=1672 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=976F9D459ABDB81E3821B1DF39CDF9B3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=976F9D459ABDB81E3821B1DF39CDF9B3 --renderer-client-id=4 --mojo-platform-channel-handle=2076 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0AD3447ACF1C911CEEA3973DABC6BABE --mojo-platform-channel-handle=2504 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AFDAAC44BC5BE9479CD594357B4FD8E4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D29E9647329BFC368F4AE5EF5EFB8AF3 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/872-351-0x0000000077AD2000-0x0000000077AD3000-memory.dmpFilesize
4KB
-
memory/1408-313-0x0000000077AD2000-0x0000000077AD3000-memory.dmpFilesize
4KB
-
memory/2516-343-0x0000000077AD2000-0x0000000077AD3000-memory.dmpFilesize
4KB
-
memory/3168-310-0x0000000077AD2000-0x0000000077AD3000-memory.dmpFilesize
4KB
-
memory/3692-348-0x0000000077AD2000-0x0000000077AD3000-memory.dmpFilesize
4KB
-
memory/3780-354-0x0000000077AD2000-0x0000000077AD3000-memory.dmpFilesize
4KB