Analysis
-
max time kernel
112s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2022 03:08
Behavioral task
behavioral1
Sample
f6540e060baf88c39cbecd4ba71bfc0459bc27057693ea216f6bcf2f58a5443b.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f6540e060baf88c39cbecd4ba71bfc0459bc27057693ea216f6bcf2f58a5443b.pdf
Resource
win10v2004-20220812-en
General
-
Target
f6540e060baf88c39cbecd4ba71bfc0459bc27057693ea216f6bcf2f58a5443b.pdf
-
Size
5.4MB
-
MD5
fe6c05e751921976dffeb4ff29b028bc
-
SHA1
5db0e4df509ed61f03e5a9802b86321b3faed1c9
-
SHA256
f6540e060baf88c39cbecd4ba71bfc0459bc27057693ea216f6bcf2f58a5443b
-
SHA512
d1babefcf2da6a908434d7a5b350512281c28f7bfbe71b18c5cb6303eef62c8d82251b420abdb5a0d95f9938d268ce51bcf658da7c22a521d901a5df720b2f00
-
SSDEEP
98304:4RNkdIYsuzYzAIz0rXBeAMptihBaOC8UAtnBRrvrHfALRV0yi1S1:4RNQIuzYEIz0FW3ihBT3hzfALH0hE1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1004 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe 1004 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1004 wrote to memory of 2104 1004 AcroRd32.exe RdrCEF.exe PID 1004 wrote to memory of 2104 1004 AcroRd32.exe RdrCEF.exe PID 1004 wrote to memory of 2104 1004 AcroRd32.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 216 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe PID 2104 wrote to memory of 4288 2104 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f6540e060baf88c39cbecd4ba71bfc0459bc27057693ea216f6bcf2f58a5443b.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1A35E5951E19BA8A461831221C8CDD01 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0310547114B4ADB9A7E027D5866C18A3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0310547114B4ADB9A7E027D5866C18A3 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=85B88F821D95BFDDF80C258337A6CBE7 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A2E79A6AE88D92BC2C1EDAC19C3EAD24 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A2E79A6AE88D92BC2C1EDAC19C3EAD24 --renderer-client-id=5 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E395E49E9F64966ABC10971D3C899E2D --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4696671FF42853D8C85D7C791FE24252 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/216-134-0x0000000000000000-mapping.dmp
-
memory/2104-132-0x0000000000000000-mapping.dmp
-
memory/3488-142-0x0000000000000000-mapping.dmp
-
memory/4288-137-0x0000000000000000-mapping.dmp
-
memory/4308-150-0x0000000000000000-mapping.dmp
-
memory/4340-145-0x0000000000000000-mapping.dmp
-
memory/4420-153-0x0000000000000000-mapping.dmp