4c54bc4e5cf87b530cba91da8997b1c6e94ffd03d6746469f327129fb84bdb90

Analysis

max time kernel
100s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c54bc4e5cf87b530cba91da8997b1c6e94ffd03d6746469f327129fb84bdb90.pdf
Size

18KB
MD5

8aa95d3265b08090e9cfe72b264c096f
SHA1

c5e4f0421bce27e150a610c480e3cc98a555ecca
SHA256

4c54bc4e5cf87b530cba91da8997b1c6e94ffd03d6746469f327129fb84bdb90
SHA512

4ede2a57e0196b734e89f596be098f3a9c9777d1fd7deab6bcdb80f5f9d0f27e3473a4c68fe38a684b0868351651dbd97a3ae11c9d119dc706e5c1a11fc0c382
SSDEEP

192:oLwhYHRq3HFwFrwwcSFmK/WykM3lxqqNbDKlS6C8A8P1zc+e27TB7qPgPiPrZoKm:AilClX+yh1hNeS6CZ8Zy9WKHXN4ZG+

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

4756 AcroRd32.exe
4756 AcroRd32.exe
4756 AcroRd32.exe
4756 AcroRd32.exe
4756 AcroRd32.exe

pid	process
4756	AcroRd32.exe
4756	AcroRd32.exe
4756	AcroRd32.exe
4756	AcroRd32.exe
4756	AcroRd32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

AcroRd32.exe

description	pid	process	target process
PID 4756 wrote to memory of 1800	4756	AcroRd32.exe	splwow64.exe
PID 4756 wrote to memory of 1800	4756	AcroRd32.exe	splwow64.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4c54bc4e5cf87b530cba91da8997b1c6e94ffd03d6746469f327129fb84bdb90.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-132-0x0000000000000000-mapping.dmp

Download