8b1299ec6041714cfee8c68f75dff28b2e2c708abbc75cadfab863e59b413099

Analysis

max time kernel
204s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
07-03-2022 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CI22_SOTI.pdf
Size

1.2MB
MD5

1b01610275e37645fd80e522f10e5901
SHA1

346055891dfb781e8fc7b2eebbb82b4d15110dc0
SHA256

8b1299ec6041714cfee8c68f75dff28b2e2c708abbc75cadfab863e59b413099
SHA512

3c4b249d58dcfb0a6b20589b336a3ad43b204e5effee1a93e5d15e6a8db5097d01e84472a2f96a5756d89f5f5ab5893691712ceffab94648ea3b724563a31588

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3392 AcroRd32.exe
3392 AcroRd32.exe
3392 AcroRd32.exe
3392 AcroRd32.exe

pid	process
3392	AcroRd32.exe
3392	AcroRd32.exe
3392	AcroRd32.exe
3392	AcroRd32.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CI22_SOTI.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads