Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-05-2022 16:07
Behavioral task
behavioral1
Sample
STERKE MEDIOR ANGULAR DEVELOPER - Angular 13 - Ngrx - Nederlandstalig - Snel beschikbaar.pdf
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
STERKE MEDIOR ANGULAR DEVELOPER - Angular 13 - Ngrx - Nederlandstalig - Snel beschikbaar.pdf
Resource
win10v2004-20220414-en
General
-
Target
STERKE MEDIOR ANGULAR DEVELOPER - Angular 13 - Ngrx - Nederlandstalig - Snel beschikbaar.pdf
-
Size
320KB
-
MD5
bc02ad97ea6f2abcd306a4b17168f3ab
-
SHA1
f26dc1664b659db0027a3918b08103772d58c205
-
SHA256
bd1563d08ee9880112b233110036c64478316758cb4fe01cb2724da25acff245
-
SHA512
3baaeb9112ea786db32a333f7f21d5b399ca44dcbe0090714077d7c29bbfcc1b4009e714846a2655449369525336735fb0f8f3dea0fbf5d2538b4bfa0ea0b9a9
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3844 3364 WerFault.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 4688 AdobeARM.exe 4688 AdobeARM.exe 4688 AdobeARM.exe 4688 AdobeARM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1648 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe 4688 AdobeARM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1648 wrote to memory of 448 1648 AcroRd32.exe RdrCEF.exe PID 1648 wrote to memory of 448 1648 AcroRd32.exe RdrCEF.exe PID 1648 wrote to memory of 448 1648 AcroRd32.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 4264 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe PID 448 wrote to memory of 5084 448 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\STERKE MEDIOR ANGULAR DEVELOPER - Angular 13 - Ngrx - Nederlandstalig - Snel beschikbaar.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=57B9ED97B06B68D1ED556A67090004D0 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C1F07A2F001230F4978231D1B1EB4150 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C1F07A2F001230F4978231D1B1EB4150 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E8747F4A049DC7A4AB9B822078E5F70 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6A1D10E07EAC4D5F69EAAD0FCCDE4578 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CE4D3C7561B4ECBFDAD12D335673EF25 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CE4D3C7561B4ECBFDAD12D335673EF25 --renderer-client-id=6 --mojo-platform-channel-handle=2428 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2F80D21E657D838D954B148420930D2B --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 3364 -ip 33641⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3364 -s 7761⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/448-130-0x0000000000000000-mapping.dmp
-
memory/1896-154-0x0000000000000000-mapping.dmp
-
memory/3120-140-0x0000000000000000-mapping.dmp
-
memory/3956-143-0x0000000000000000-mapping.dmp
-
memory/4264-132-0x0000000000000000-mapping.dmp
-
memory/4608-146-0x0000000000000000-mapping.dmp
-
memory/4688-153-0x0000000000000000-mapping.dmp
-
memory/5044-151-0x0000000000000000-mapping.dmp
-
memory/5084-135-0x0000000000000000-mapping.dmp