7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e

Analysis

max time kernel
69s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2022, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ebook_Limit_Order_Book.pdf.exe
Size 2.5MB
Sample220923-ff89fshahn
SHA256 7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e
MD5 acdfaf2d9b94f13f469a679f1776bcf2
SHA1 61fe1b627fe4467b64e5881e603ced520908484b
SHA512 907d8111c9f359cfe3922876620e72ca68cb4eb1b96074b50e18f196cebeff1348561f007ca31332fc3e642342969198beac66cfb5ae3cb8d0fdff935d0519fe
SSDEEP 49152:7B9Xmlxc1jEc05RiyP7hVHR9CbYdTqNBbn5FryvL6O:F8l+Wc4FrHn/qNBT42O
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Ebook_Limit_Order_Book.pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	Ebook_Limit_Order_Book.pdf.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4892	5108	Ebook_Limit_Order_Book.pdf.exe	83
PID 5108 wrote to memory of 4892	5108	Ebook_Limit_Order_Book.pdf.exe	83
PID 5108 wrote to memory of 4892	5108	Ebook_Limit_Order_Book.pdf.exe	83
PID 4892 wrote to memory of 2332	4892	AcroRd32.exe	88
PID 4892 wrote to memory of 2332	4892	AcroRd32.exe	88
PID 4892 wrote to memory of 2332	4892	AcroRd32.exe	88
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 3460	2332	RdrCEF.exe	91
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92
PID 2332 wrote to memory of 4132	2332	RdrCEF.exe	92

C:\Users\Admin\AppData\Local\Temp\Ebook_Limit_Order_Book.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Ebook_Limit_Order_Book.pdf.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\verifica_spid.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=59FFF45029955195A7EF8B8A55D45C4D --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=735DBD62ECC2D58D0A2A9C701656F427 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=735DBD62ECC2D58D0A2A9C701656F427 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D534B45E8D40AB13DBF15E8BF0477AB5 --mojo-platform-channel-handle=2188 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CABB688BAD87B9D7353D405F4D0F653B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CABB688BAD87B9D7353D405F4D0F653B --renderer-client-id=5 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6B032CB18590BAB4F356F66E300E7838 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=215F78FFEA6F94E6EC3CBE9219043501 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

verifica_spid.pdf

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\verifica_spid.pdf
Size 252KB
SHA256 c55c43386176a00ac7874117fd9535afd71b474669e63da19d89c57b819c54e1
MD5 f3e24dcc744c0283c3491cddc7ff763d
SHA1 aff25d3a3dc5b34580c995394529ef74625ae8bb
SHA512 99e70fded33883face67c270ee2140c396cbe01c552340fab5dc65158f098cb222cc1987cbfeb90aa701ba28032906fa16e0563544dab47b3c32a664b3cdc021
SSDEEP 6144:nPOmw43KNFsaw9fwSCLqx8GtKRIzZQux2Wa:dw4anshRwSgySeQq2Wa
MD5 SHA1 SHA512 SSDEEP

Submit Download