Analysis
-
max time kernel
48s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-05-2022 02:00
Behavioral task
behavioral1
Sample
DTO 250522.pdf
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DTO 250522.pdf
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
DTO 250522.pdf
-
Size
347KB
-
MD5
14178e481c837409f01855e5608a979a
-
SHA1
43aa9d2fcc76ab2f350e1a6bae2448d1a40e6fba
-
SHA256
3ed75b22528e269c6e025dc4f5f2866a0bc915cd31c2f6ec337049e59b875427
-
SHA512
f7a1a1e5071c6dfa2e1950ce3a0ce263d85f14bb1a2dee1fa1bf0c6aaace53338782a30999c44a221fc21d0a2f4c5198f5fc8307f091e747fd5f11990c1f0ae9
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 796 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 796 AcroRd32.exe 796 AcroRd32.exe 796 AcroRd32.exe 796 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 796 wrote to memory of 1852 796 AcroRd32.exe RdrCEF.exe PID 796 wrote to memory of 1852 796 AcroRd32.exe RdrCEF.exe PID 796 wrote to memory of 1852 796 AcroRd32.exe RdrCEF.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1520 1852 RdrCEF.exe svchost.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe PID 1852 wrote to memory of 1420 1852 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DTO 250522.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=21291957C320DB0D5EAE91F0BF0741E3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=21291957C320DB0D5EAE91F0BF0741E3 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BFB87A8FF79182D72BF6197FCDF0621D --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C83859AD42BF8C4C0AC6A7EBFCD1B154 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3BEB6CF0E8183C1A9739E84F9FA3DBB6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3BEB6CF0E8183C1A9739E84F9FA3DBB6 --renderer-client-id=5 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1881CC5BD44C247695412079EA38042 --mojo-platform-channel-handle=2524 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7BEACB62B596D95CC2EAE4742133B46 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-148-0x0000000000000000-mapping.dmp
-
memory/1420-135-0x0000000000000000-mapping.dmp
-
memory/1520-132-0x0000000000000000-mapping.dmp
-
memory/1852-130-0x0000000000000000-mapping.dmp
-
memory/2040-140-0x0000000000000000-mapping.dmp
-
memory/3036-143-0x0000000000000000-mapping.dmp
-
memory/3128-153-0x0000000000000000-mapping.dmp
-
memory/3840-151-0x0000000000000000-mapping.dmp
-
memory/3932-154-0x0000000000000000-mapping.dmp