Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-10-2022 10:07
Behavioral task
behavioral1
Sample
d45eee839432031ca286c2fd7ddfa7cb663b3f93aa056454d3098b85a805664e.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d45eee839432031ca286c2fd7ddfa7cb663b3f93aa056454d3098b85a805664e.pdf
Resource
win10v2004-20220812-en
General
-
Target
d45eee839432031ca286c2fd7ddfa7cb663b3f93aa056454d3098b85a805664e.pdf
-
Size
2.3MB
-
MD5
48d122a8022293b6c14b452e28761497
-
SHA1
c5bf662a4e8e9c3c1638f3816cdc1831dcfd07e1
-
SHA256
d45eee839432031ca286c2fd7ddfa7cb663b3f93aa056454d3098b85a805664e
-
SHA512
fffc0e41029fbd16a8a42d322b33b0d9b7639439dd2c4361615a96715657f60c016c79a7b79fe0e4abf9e78960d42412186c8eb7f26833fd62214a8536a86bec
-
SSDEEP
49152:T9iqVRzIbrXr1sqxZePvUbZ6KeJKWuRVH8mXFe5hkqfh:kUs3XrsvOZ6KWSVvV21
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 536 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 536 AcroRd32.exe 536 AcroRd32.exe 536 AcroRd32.exe 536 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 536 wrote to memory of 3472 536 AcroRd32.exe RdrCEF.exe PID 536 wrote to memory of 3472 536 AcroRd32.exe RdrCEF.exe PID 536 wrote to memory of 3472 536 AcroRd32.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 3396 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe PID 3472 wrote to memory of 1716 3472 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d45eee839432031ca286c2fd7ddfa7cb663b3f93aa056454d3098b85a805664e.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ECB9CB85EADE381DA410ED115D053E10 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ECB9CB85EADE381DA410ED115D053E10 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=82834C1115160D0186053A4ED0272340 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8B3C5BDE7A1DEC1D259C2A77C29B3050 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8B3C5BDE7A1DEC1D259C2A77C29B3050 --renderer-client-id=4 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job /prefetch:13⤵