Analysis
-
max time kernel
154s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 18:48
Behavioral task
behavioral1
Sample
attachment20220906-20109-12dgdoh.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
attachment20220906-20109-12dgdoh.pdf
Resource
win10v2004-20220812-en
General
-
Target
attachment20220906-20109-12dgdoh.pdf
-
Size
923KB
-
MD5
057db28df65f1fa9d409bdb8c64f791b
-
SHA1
3a76d912b9a8f3d539e59e994b6903539ac9822a
-
SHA256
55b83a18bfe96316e7b42c73e7aa9a69d0e0291e24125675b0d6bdc1c6637e79
-
SHA512
651b9ff3b5a60d2126ff0bf7fd61a2f634cabb631ccf28551763519f20551551efe7b90a6a746b86e0e0471413b2ca9353acdd6416ef86b17a890bea0cee1655
-
SSDEEP
24576:pTEoJTOoB/QbwY5ZP1dVINcnElQzy02K49/itlPU3Kqjn:soIbVg0NXXPU39jn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3064 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 3064 AcroRd32.exe 3064 AcroRd32.exe 3064 AcroRd32.exe 3064 AcroRd32.exe 3064 AcroRd32.exe 3064 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3064 wrote to memory of 1812 3064 AcroRd32.exe RdrCEF.exe PID 3064 wrote to memory of 1812 3064 AcroRd32.exe RdrCEF.exe PID 3064 wrote to memory of 1812 3064 AcroRd32.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 1844 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe PID 1812 wrote to memory of 4176 1812 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\attachment20220906-20109-12dgdoh.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E0C0DC3EE896FC4F5D7851AD53C01D6 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1844
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8BFD2F4C6CCFE7277DD37383F9E4DA28 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8BFD2F4C6CCFE7277DD37383F9E4DA28 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:4176
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A3FE5DE08FFEFB606820C1438D13D931 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A3FE5DE08FFEFB606820C1438D13D931 --renderer-client-id=4 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:13⤵PID:2304
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F458CADEFCDAD427E47FFCE4A1649681 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2976
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E4187ABA7F7DE2115D85B7DC3F007AD6 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1096
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1356
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-150-0x0000000000000000-mapping.dmp
-
memory/1812-132-0x0000000000000000-mapping.dmp
-
memory/1844-134-0x0000000000000000-mapping.dmp
-
memory/2304-142-0x0000000000000000-mapping.dmp
-
memory/2976-147-0x0000000000000000-mapping.dmp
-
memory/4176-137-0x0000000000000000-mapping.dmp