65b699b48df50eccd2ce4e306771b603fbdd9e5be407dfed87b271808826a8f2

General

Target

65b699b48df50eccd2ce4e306771b603fbdd9e5be407dfed87b271808826a8f2.pdf
Size

48KB
MD5

4f043f4fcafd942d7d3f767d1565d42d
SHA1

1c6d88e39b6c93a16365e137275b93eeec89b830
SHA256

65b699b48df50eccd2ce4e306771b603fbdd9e5be407dfed87b271808826a8f2
SHA512

16d85a7d3f2003998e997c7c77a917cc43adc21a7dbad7dd6a0f192cdf92c414fd0d89004e602b39f8f292e6ad0d98611fa54a926fceabef0a6ee933c6868d65

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018C005EAEB5B44 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000952a648048c616ca69135f87cf803e601d523afd0f3bfc290d2a1264f3f4bcef000000000e8000000002000020000000a4d857b6fbd58fba9b87fcc67f6a5c670125d7f58828bd6b078d68e69e6f76f280000000bccbbf71a9cd9e8e4372d1c11b44e5f34cf93258ccf0d8a0e60b673b3c5f55b2f23007f9cd793eb242d7b8589fdb4241f52332406048163c93c952df17a0e4d4138de2eb9d845cae9de3578c3de85c6202354dc8dd7512d03c963ed5c96bba4fd1a976d294415410baa171be829f3b3c070b5a02ecf81458a38ba531e474957740000000b401b3cd0b2c95bad70f961bce4e5cd751161c9409e85e4da1a766817439d6b39e3ba08673e7e0bbc21ca40ecb2b30e9b14cd0ca7bb519c654bf7d6ee7024556	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000000879b124077844a49e10cccf833798b1f06f0996af086a48092a0b38cc0f6777000000000e8000000002000020000000f401dffc6e2513391bff107756b1dfcb6f9a82b75a4fcf8830403fca1603dfba100d00007df5aed7bab9122fd0232bb22bf13d8d7c60de099f92803c82b27829bd1f02275158a77aad890f87e1337a433aacda68075d22f5f57add32fb0fd4d2d5b0080e5e22de1f325bd0e157c2efcf2736018a955e6dfdb30f350311b3a0a7349ffb1d4eecad9237f5f16972e69331e99481daf9d596a6795b594a00669badbb90bb06452002c13dca9088759825835ba3c4f5f748ebc73603a8acc449ef2b18ce7456a6a1fea1338592abcab7554e64a596f78049a66b68e524d9479d4d7cd4402402947b2fc6f3b64b143b23b1781dab3f952ebb9676299916fc04cd970e1f5a7498301d62d54197f7a67ebb2c7e0f3835990fa05578e22a80599a5f2246f85a08b474e648957a4359307968d9569b2b97de50bea18a22e9d4a648605c08caf7044d62b3a9fff34433a67f833cb8f9c8a0bcc3383fdad3d332bce943ae5e293fa4362b3065dff0ee0ffa348fae4c65289df13807aba77b8b4ec951c603bd1b01e2c119106a4a9832aa1aeaed87eae574111e1e1d7e76dd56f71020e89c763480ad8a2e7ba578b6affecd5c051e21d912c47b84b020c7db2727f2124fec22630dac4b4a972eabc8a5d06a5f3b28d04da2c3f2a737c8acfecf9cee831e47e19daad924eafc74efbf6fd88a7d5890a41e59d2f71c9162ecef6a38f71dcf1e96a55dc8afeec3a92b13786497dc19e55a977dddef59f9aaa2661c6bebfbf381ebe6493a74fb895220fcebfbb08dc944f3e3cabf37a98a78595d644a3dbb0c3868e06d11c089e1f8f3052df57c43d0a6aa2a1550bc2d1d1e94da5a428c55008ac387e0e0169c7cdf5e66885ccc9b810b8e8b4455c9d4ceb1f5d04d6718b7ba91805fbe56532c298e7c48915a6f095892eebcb1d0c981a62daebf0b24522d3bd82523f9875b2cd88874d5b4566e5922a44e53d09ba237420e9193e1cebe6da9cb4a488666b58f79a628e46f2f34d686934d147fa903bac5027377ca6a2e86f3f40a2254d427590319a93200e45e9276fa10e3aa0767246594532cf53517f820f90561e0b576c8308f48a790f2291e82a3d9f1b498722495005960ce016de8b5eabb37546b2de5c8850fa024bb2a08ef6b086498dbe2366edc025025ac4f11a91f053386827460e5175bf813db6c6fafc8be06e10670f4382c84374f1e84c10ae12b9f92dcb5922b42d619159b945924b1e0a65d8a8f24541642e31e92296edbec50fbd0e5871daa4e9daed088bb2c4e68ab45fe060d352daa1e97c5ec38b146d2dd220711f8f857b455b7ad09bfbe1b31e5599479d57247c2e40e79fb140cf1c94ea85d1571719753d76a7b734847698cae8f21e0ae867157586f2180171a70dd935433982540a3af8394f3d20ac9d51a1eac6f53da53753e50d0851682e09c017f721233d9182ceef0ce6add1aaf90b717c1f69fcde7fbb1d4d7dc819709d3cbdb0d84469aac3e69bbcaa2a72ee4a5f0335f42550871bddc27e059db2cd567680cd0374ad29ed44f37f4297291bf0201b73e8dc601c4fd7b3046fb1831711443b2441c187148fde84e71bbebbaf74c63ef71bdf6bc951c4a90a0e2957b57e85bc5d03e60d68137e7541a06e4f6da68f18f923296707929bad2831257810a71174ffc83df1673d7cd659d5dd8dc98c6f15f5d3d8b62a9c68f4429fda37409cd3dbd80260d2dfac0415e77b40e94a0f61ba1f139b5aed86f9973344c74308a64ba84f20221f690c54b045f30c33bd81eb975c927dd2107fff3fc37b528c110d9d2e7c78193f6474d20040f11c94ccef6ab8e91cef83557702684b8afbba1f79fb20df4260b7943361e56351d478ef1065dcb5daa4dbda02d61646d950ad7716fb89d8f61a4bb9611f1f9be0ecdc5b588b2b1e7badd60c7aebbe6f4f0a0dfd9dbb920b985d0b008dc417efdba8b5beddc79ea8b7c285f92faf6b772dcd5ce58a18cc73e69b3096469ca5e758a7983b8cfd6edc0508f7196d011294bcb2d470c18f9512adf5befb0c760dfc0d671c67df66ad95c03a399d475eef9db1b712c0c9c0a8b0ee7b544f8df9fea8f2173130aa16ad58301f96171d90c493a5223a3874dfa6e8f3032f9a1e79dcbc131a5cd84eeab69b6a036f3d056f2f7f830953f8a45fef3d0fa2bc5fb6bd671d078ed0b2fc842986759cadff3fb31e9678a9292932b6ff22425769a246979f604ecf70a81a929b3007282d21202b909687e3b50c611dff2a2e0510181ad3739d5bdc8b23dc4041aa1d6dd6271e09e7a8d9be2abbac9dc1ab3ebfbd07bc3ef95cc656b6373354a79cb76e6133486291966af0892b03ea9ead80d38f84906d90e88f5d831e78e60a698a1d8ba820b8f5ecb6011ea70c97b90afc98f2c87060ef11b9da88b7da6a1683ae5491c601411cf40b9ee5da6b87b351ff500132e7ae5c98f66bb14814d69f5c83765c539afb02b4acb10a137feace065219d6e5b7b262f9429c09e1b978e6d29bc0359eb3dda9cae32c12f78dcd0298803e677472fe8be9f3e9e7b13cc0522a225979659f51e04f28c3fce203d60634f72f34eb2421473840223a13e4338627d396091377995c82dc6bd017f42ee8d511510f4ee0d66e831bd5faef355fe9d82b9a0dffa3960cd1efc0b24d87cb8e9f5b3810af6365d51f89108bd246d610d2ebc7096e5cf5f0eca8d914b5e0d94998a270f1d37eddc6c1fde93697ca63109807b16a249c658fb8bed31975c31063a0c9a683e7ccb297f47f1132935d5cc68ebd7c2ea25d89c19c00ba0bafbf9a7709833dedca17de2d014b606f6abe9860adf099d674bfcc7145879a1c36c4d68fc4966d2e40308bfbb026118fbb83d6a1cfc607ad5f7cb1fe9c035559fe5c4a70afc98710daafbdce4afe17ee5f210c41d2069949c71ff1f2c238dd0d800125f8322c66bacee89ffc5f11443fd916779dc094b85492d83b8e6ff694faa7e5dfcfcfa915473f80c35787617b001a81c7fcefb6bbbdefebc33ed2b4f0b4ad1e2657b98b4a5a4796d83dc2a3c75f3ed7ac480d083d51d2db24906ca5b4d2a9f91b67ac506adf3c971d7e20dd815839f0ee557f039cf22733a336a4629fc49b8217c09767958c37814819489b8e801329ff7a7df2fb01baf290de56737f094e5b8ac35bf4f5a24949c8b9140b84ce58c041cdef30a3d2ea1d752ca1b124b468c3732da1a6bf356d63f7bb7061a9729a958517f1f44f5872ce0dcee5b78291fb7704695761eb87f5153b201a50085f8f385465f20c959f5b689c5ead2e89f3c29385638f2dc237262fee30bdfbebfc6e7c7fb2017c8a55587ba4369589397b3d8af37e87fd3225db299b1f14ff2c063f8df29d3ae22603ed4f56590aba297306468e1ea8507d711a577c1ab15405f21522a26a6025da008c254e61901bc776266c5433130c6143e3e7b48c9fafbffefb1516746eee72e60dc0f3ed07b52f40005b7c61b3ff5fa972075eec65ce60c895100c62bd10bcbf89be90eeb618d18a7c36461ce72171aa1deb91cef424885fff967d14304cb8cbb8104f3fd98e9945a0ada2b3cdeed4f9f08ba983b1c695a2ea0187bcd5c9ed4f6a1fe35e6cb1c208c56accb72d88583bbd7560422640a9768e25158e938ce603d60264cb5298141482c12803ee28cb87e8f53da58627b4354b64e79afdd7bb0a9e6f67da0c3761122ca2d8380221c3e009dd2f3892af5acf5f86f879b7cb917d167b7e0f736a71e6468bad84ce6fab3bcd79be5fa64649aea5282183b793b7a772e82830b21ca6a909be04be8c1c53f0622f4bb925f97bfac1c446e69c45603cf1f8cf87202a5f759f20d1e24bbd11e99e49ab6780e00ce68dbe882fe89fb1becb4bfe9b4ea4a219c3bbe43314fe98badc801296da1f7008320bf22aef831d85477900db5d5fb6c336b8a200786bc31b469744bb23c914fa6ac0b11341fec9425a730e2dd97c9f704c252d693412dbf18334fc2d99ab2dde02be7ca381c1d88c328ee2cc75414b9811788d8b187deae10e6c89048aa04633d3bee5f9888851aad7df1178252bd15c215f406d759e7726b50357456e8d3ef5d0e484298e49d1ae422a293e97bb178bafd3b21d762adc520f62597ef7ba583554486065bd9f98fdf807bda2decf9faf25eefe280b2afe56cca348aca259687494f5ec2baa8dcac6ac00e67929499ef982452b516dc811b7491d2a60a7a8d73ad6f601a56e6861f8c48335ed2bf7db18500488ea92105e3cabd98be26631f5566e95832943d2ac5c4cf44880abd2fb2b2fb557761676a303844fc8846454a7209fa1e6b155ce4e23fd8b396acc8006956e69a6b6c15365fe1f483ddb34ce433297cb2f672961e38c059928aa232cd03b7977ee7e8a5fb205bb7e858874053629f3428f41a6bf8dafaebb45c3d3f63657d22af80d17e166dbac17c54fd7cddac66c3502ac9996d7fec642d7bedafb72d0fe843b201e534a305f099eaccf663872f60104fb1d34c462d24a0928239560812407c84fdaeb86c55c0373491c01e2dfe0c917dabaa590929f5ff4cbf377b2fdcf246bf9e27376354630f222ef85209c496a60804bb678bc7c24a6d7cc054cc7fa1bf94541ab3d283086ad858c4816420645058258cdab6e904ab64c9571f2db6b45a60b2228db1a85a6b46d0bf94171c26f6b7ce153a47bb08077fe689b506bd692a0a414cc472435c43ba0e888572bb641f9c13185497dc676309259b826966becf7ed28221690ad57dd5de806a3629f8a9c8ea8f63dae740000000bf92d99eaf0a731dfcc6ede00942ce95af92f95116e2b7ad3bb2cf0a2e9522ac308bd4f9e758b4cf9a4c3a62d79364838bb820b12e53ccb80d1b75ccf8374fe9	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018C005EAEB5B44"	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4332 AcroRd32.exe
4332 AcroRd32.exe
4332 AcroRd32.exe
4332 AcroRd32.exe

pid	process
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\65b699b48df50eccd2ce4e306771b603fbdd9e5be407dfed87b271808826a8f2.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads