773365765b15ea9c6fff1a7c8cd943596c079c6d3fc8080e10407bdcbca1f70d | Triage

Analysis

max time kernel
99s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-05-2022 09:20

Sharing

Report Analysis Logs

General

Target

document.pdf
Size

1.1MB
MD5

ec0a5810904a5ca18358a79a6c56fa94
SHA1

c10ca8748a9166ac421861b02ff48d32dab5a416
SHA256

773365765b15ea9c6fff1a7c8cd943596c079c6d3fc8080e10407bdcbca1f70d
SHA512

d8700bc1ad38c1e10241fe296302585c66772d97ddb2723e025923a078c40ace44273a69f0da70bda652a4eb795697329e793cb52414fbab98f4d359cd82a09d

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

Processes:

AcroRd32.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	AcroRd32.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	AcroRd32.exe

Modifies registry class 5 IoCs

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

536 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

536 AcroRd32.exe
536 AcroRd32.exe
536 AcroRd32.exe
536 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\document.pdf"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:536

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:828

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/536-56-0x000000006F4D0000-0x0000000070826000-memory.dmp

Filesize
19.3MB

Download
memory/536-57-0x0000000004C50000-0x000000000589A000-memory.dmp

Filesize
12.3MB

Download