Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2022 11:12
Static task
static1
Behavioral task
behavioral1
Sample
2022 ??????????????.pdf
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
2022 ??????????????.pdf
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
?????????? Bate v0.1.0.2.103.6.exe
Resource
win7-20220715-en
Behavioral task
behavioral4
Sample
?????????? Bate v0.1.0.2.103.6.exe
Resource
win10v2004-20220721-en
General
-
Target
2022 ??????????????.pdf
-
Size
414KB
-
MD5
f326e76cf53e4ec870e3f01a44fcd2c8
-
SHA1
c429301ea04fbe29413280095dfad6c1faedce9b
-
SHA256
e0c93b9928653a0bd65f68869dbc4832ca6f8d04392df893fcf54e41b2f323b2
-
SHA512
04a6fa3a7f6a2030f0cafef12643e078918b77a8dcd0298848d231161f6c60ff8e64b892f061892567187a7ca6d042f1a60f09873fe01f5aad142055812a5865
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe 3696 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3696 wrote to memory of 900 3696 AcroRd32.exe RdrCEF.exe PID 3696 wrote to memory of 900 3696 AcroRd32.exe RdrCEF.exe PID 3696 wrote to memory of 900 3696 AcroRd32.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 1880 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe PID 900 wrote to memory of 3080 900 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2022 ______________.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E04B49BF992157739292017AB49C8C3B --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1880
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=768DC4B3B09C6BF207D4F1E0BF9C1FC0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=768DC4B3B09C6BF207D4F1E0BF9C1FC0 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:3080
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8568319388768BAC43CE19BAB1AD70A2 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1008
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8BDC7D4F14E02843526A68592BFC103F --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1484
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0B162D5A9E398846223A651A6ACA490A --mojo-platform-channel-handle=1544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3760
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3092