Analysis
-
max time kernel
72s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2022 18:54
Behavioral task
behavioral1
Sample
876d4cc8a7d6401be7a40c9992735b6e8363e89a191b06d1786bab34ba806dae.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
876d4cc8a7d6401be7a40c9992735b6e8363e89a191b06d1786bab34ba806dae.pdf
Resource
win10v2004-20220812-en
General
-
Target
876d4cc8a7d6401be7a40c9992735b6e8363e89a191b06d1786bab34ba806dae.pdf
-
Size
444KB
-
MD5
f5b17f95b6dd5f5251affe268a96bb34
-
SHA1
b196a1e1025ef345d7eaad79deaea93e3b6d10ab
-
SHA256
876d4cc8a7d6401be7a40c9992735b6e8363e89a191b06d1786bab34ba806dae
-
SHA512
f87d73a27edd5bf1eae9c2ceaa89f44d55b85a524ff71312577b1044128bb3eaff397a9d2ffd0b774dd969eb8e6be802f7395f7b635eb3c2dccd38f62c608bc3
-
SSDEEP
12288:t8cMdUOhqgKyxy8ZBQAe1xYUZd/fYEPyDsmj2v5:t8OBgpckBQx1VZdnVPy3y5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3584 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe 3584 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3584 wrote to memory of 3532 3584 AcroRd32.exe RdrCEF.exe PID 3584 wrote to memory of 3532 3584 AcroRd32.exe RdrCEF.exe PID 3584 wrote to memory of 3532 3584 AcroRd32.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 4704 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe PID 3532 wrote to memory of 1496 3532 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\876d4cc8a7d6401be7a40c9992735b6e8363e89a191b06d1786bab34ba806dae.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FEB7E99080A9CFED55FBF73BDD3ED169 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4704
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D2F92D933662AA0A3F14CF70A4BEF453 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D2F92D933662AA0A3F14CF70A4BEF453 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:1496
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=560625A52E92AE53F4C08356F1A8B8DE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=560625A52E92AE53F4C08356F1A8B8DE --renderer-client-id=4 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:13⤵PID:3828
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A4074AF60C66126065FE0BB9D80238C --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2760
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9E3BC5DC1AD6508D4238B8C1F48F1CC9 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4736
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7ACD28F8BB3FDCCE072B435D6034F598 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2376
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1496-137-0x0000000000000000-mapping.dmp
-
memory/2376-153-0x0000000000000000-mapping.dmp
-
memory/2760-145-0x0000000000000000-mapping.dmp
-
memory/3532-132-0x0000000000000000-mapping.dmp
-
memory/3828-142-0x0000000000000000-mapping.dmp
-
memory/4704-134-0x0000000000000000-mapping.dmp
-
memory/4736-150-0x0000000000000000-mapping.dmp