Analysis
-
max time kernel
158s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16/06/2022, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
WHMSHC22060125_SUR.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
WHMSHC22060125_SUR.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
WHMSHC22060126_SUR.pdf
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
WHMSHC22060126_SUR.pdf
Resource
win10v2004-20220414-en
General
-
Target
WHMSHC22060126_SUR.pdf
-
Size
16KB
-
MD5
ea507a9a7c1ceb3b36384049c57315b7
-
SHA1
17bbc4d916c15d3172670ece4579a48dffd8b88f
-
SHA256
79155f486cc60650f2638e39f960b5bcf3af6ed9af572cdf73a7a75cdab38414
-
SHA512
fd58a6794c39fa925a6026455ebd7f9eceaef16eec9d5d79e324963a0bd877322343a704c21d6090d7af166d6fc1804cf894327cde0227a9efc83642233b4dda
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 432 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 432 AcroRd32.exe 3980 AdobeARM.exe 432 AcroRd32.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 432 wrote to memory of 4740 432 AcroRd32.exe 85 PID 432 wrote to memory of 4740 432 AcroRd32.exe 85 PID 432 wrote to memory of 4740 432 AcroRd32.exe 85 PID 432 wrote to memory of 3672 432 AcroRd32.exe 87 PID 432 wrote to memory of 3672 432 AcroRd32.exe 87 PID 432 wrote to memory of 3672 432 AcroRd32.exe 87 PID 432 wrote to memory of 4804 432 AcroRd32.exe 89 PID 432 wrote to memory of 4804 432 AcroRd32.exe 89 PID 432 wrote to memory of 4804 432 AcroRd32.exe 89 PID 432 wrote to memory of 4508 432 AcroRd32.exe 90 PID 432 wrote to memory of 4508 432 AcroRd32.exe 90 PID 432 wrote to memory of 4508 432 AcroRd32.exe 90 PID 432 wrote to memory of 4516 432 AcroRd32.exe 92 PID 432 wrote to memory of 4516 432 AcroRd32.exe 92 PID 432 wrote to memory of 4516 432 AcroRd32.exe 92 PID 432 wrote to memory of 928 432 AcroRd32.exe 94 PID 432 wrote to memory of 928 432 AcroRd32.exe 94 PID 432 wrote to memory of 928 432 AcroRd32.exe 94 PID 432 wrote to memory of 3980 432 AcroRd32.exe 95 PID 432 wrote to memory of 3980 432 AcroRd32.exe 95 PID 432 wrote to memory of 3980 432 AcroRd32.exe 95 PID 3980 wrote to memory of 2260 3980 AdobeARM.exe 97 PID 3980 wrote to memory of 2260 3980 AdobeARM.exe 97 PID 3980 wrote to memory of 2260 3980 AdobeARM.exe 97
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060126_SUR.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4740
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:3672
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4804
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4508
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4516
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:928
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵PID:2260
-
-