Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-02-2022 09:29
Behavioral task
behavioral1
Sample
jena_263905_prep_20220208101946812.pdf
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
jena_263905_prep_20220208101946812.pdf
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
jena_263905_prep_20220208101946812.pdf
-
Size
13.6MB
-
MD5
169a041e1604adfed0d5970f71bf0405
-
SHA1
c1df58d894e30800a930bd60a6ea07def2419fa2
-
SHA256
9ef15870104a32b1db6b60b11ddf62dbd87f0c5e84d7f382ea56b651d560b150
-
SHA512
e1c62890a28b27f0f7e386170899c8cffa8e53addd7ee3bd5d6f07a22b1e817230eeeda08b151d61011005d7a37ba26cbc49eb3c8ec0acd238f92489eb5aff5f
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
AcroRd32.exepid process 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2392 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe 2392 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2392 wrote to memory of 2780 2392 AcroRd32.exe RdrCEF.exe PID 2392 wrote to memory of 2780 2392 AcroRd32.exe RdrCEF.exe PID 2392 wrote to memory of 2780 2392 AcroRd32.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1160 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe PID 2780 wrote to memory of 1120 2780 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\jena_263905_prep_20220208101946812.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A72FC6E9739812297D67B1780B288518 --mojo-platform-channel-handle=1644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=14407FCD974DDAF6B8BD1D8F25895E7C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=14407FCD974DDAF6B8BD1D8F25895E7C --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=67656954F0E885862ADA35087F5FD456 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=67656954F0E885862ADA35087F5FD456 --renderer-client-id=4 --mojo-platform-channel-handle=2208 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EBA9AC7ABBB05EFF6B6E398B83A220C0 --mojo-platform-channel-handle=2492 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=118E0F351E3F8291A16137344676EB45 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7385B75E65E8C6AA86E12AF19490663C --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/796-122-0x0000000077662000-0x0000000077663000-memory.dmpFilesize
4KB
-
memory/1120-117-0x0000000077662000-0x0000000077663000-memory.dmpFilesize
4KB
-
memory/1160-114-0x0000000077662000-0x0000000077663000-memory.dmpFilesize
4KB
-
memory/2828-130-0x0000000077662000-0x0000000077663000-memory.dmpFilesize
4KB
-
memory/3776-133-0x0000000077662000-0x0000000077663000-memory.dmpFilesize
4KB
-
memory/3920-127-0x0000000077662000-0x0000000077663000-memory.dmpFilesize
4KB