1e71b3eaf49ac89c4a6ff0b2fd7f03b58828a851c54b0207f214ce8374efce1f

Analysis

max time kernel
172s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-05-2022 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

999Fund.pdf
Size

359KB
MD5

1351b278d9e96b1a846042317449720b
SHA1

862db515c1c797464f70986d6024c6992c20b8a8
SHA256

1e71b3eaf49ac89c4a6ff0b2fd7f03b58828a851c54b0207f214ce8374efce1f
SHA512

409e3c81e15fb57b21371e31fadb23c20d7b845a9b64e2271b1e52fb528be0b5a7186a546df6d7af7ff9b6fb4496d68e1a6fe6b78e6c0b87bac3c7db1286d112

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

1432 AcroRd32.exe
1432 AcroRd32.exe

pid	process
1432	AcroRd32.exe
1432	AcroRd32.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\999Fund.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads