Analysis
-
max time kernel
95s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-04-2022 12:21
Behavioral task
behavioral1
Sample
QMCO053193 Speck Pumps YAN-SAV FCL 04 22 22.pdf
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
QMCO053193 Speck Pumps YAN-SAV FCL 04 22 22.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
REVISED BOOKING (04-25-2022).xls
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
REVISED BOOKING (04-25-2022).xls
Resource
win10v2004-20220414-en
General
-
Target
QMCO053193 Speck Pumps YAN-SAV FCL 04 22 22.pdf
-
Size
60KB
-
MD5
85734b1437b83936499b75c3714da72d
-
SHA1
b3e83cc1fbe3df90c32cf1fcba87f959961cf91a
-
SHA256
d64328f9bd62ca0dd3e89e2b5ab49a0828504f383a2c36daf61a760e3173dfe2
-
SHA512
3b6ceaab70e0b4e1b802394acf1bea8bcfc491cff35eadf91730c45ba0dd953f0fd1c0ddc7ee98bff77abae3de2e55c8b9e62ad529311e8f0647b2d56f4c6e3c
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 916 AdobeARM.exe 916 AdobeARM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1324 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 1324 AcroRd32.exe 916 AdobeARM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1324 wrote to memory of 2380 1324 AcroRd32.exe RdrCEF.exe PID 1324 wrote to memory of 2380 1324 AcroRd32.exe RdrCEF.exe PID 1324 wrote to memory of 2380 1324 AcroRd32.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4244 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe PID 2380 wrote to memory of 4536 2380 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\QMCO053193 Speck Pumps YAN-SAV FCL 04 22 22.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=07E771527E61114E2B2D66BB9FB51D98 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C56C13F43590A89496BB298F4F2FAFE1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C56C13F43590A89496BB298F4F2FAFE1 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FAB2EEB3A2486D1AB5BD65A9B4429961 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FAB2EEB3A2486D1AB5BD65A9B4429961 --renderer-client-id=4 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=79C5477C91A253F29AC8F5EBB9E0E4DA --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F5A121B044AAD3BB3ECD6FFA7655301D --mojo-platform-channel-handle=2540 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7C3E961C4EA25EDF3FB3295D5DA9368C --mojo-platform-channel-handle=2020 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/228-151-0x0000000000000000-mapping.dmp
-
memory/916-153-0x0000000000000000-mapping.dmp
-
memory/1756-148-0x0000000000000000-mapping.dmp
-
memory/1960-144-0x0000000000000000-mapping.dmp
-
memory/2380-130-0x0000000000000000-mapping.dmp
-
memory/4200-140-0x0000000000000000-mapping.dmp
-
memory/4244-132-0x0000000000000000-mapping.dmp
-
memory/4328-154-0x0000000000000000-mapping.dmp
-
memory/4536-135-0x0000000000000000-mapping.dmp