Analysis
-
max time kernel
122s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2022 09:18
Behavioral task
behavioral1
Sample
双语翻译版.pdf
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
双语翻译版.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
知识图谱论文中提到的第21条引用文献.pdf
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
知识图谱论文中提到的第21条引用文献.pdf
Resource
win10v2004-20220812-en
General
-
Target
双语翻译版.pdf
-
Size
995KB
-
MD5
667a086b873c0353e413e659b166c9be
-
SHA1
3b0aca4651459e47e56f47c808426cec868360b0
-
SHA256
84fba99981eb9a4f4ec71f94f8f11fc586276ba4e98aaec2ac0457b76771ffdc
-
SHA512
9014918965b4c42ef248304723b9070f7fee27a683a5d1c8dfc57d1acc6385bafebe78e2727bb971d0c67999122bb91628628ac1104347aa321869768f4ad093
-
SSDEEP
24576:fEBrizR8VxGv1nohLjECVmWI4ycbdw2Tw2kJK:OraR8VcnoxEoicBws9x
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 5048 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe 5048 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 5048 wrote to memory of 2504 5048 AcroRd32.exe RdrCEF.exe PID 5048 wrote to memory of 2504 5048 AcroRd32.exe RdrCEF.exe PID 5048 wrote to memory of 2504 5048 AcroRd32.exe RdrCEF.exe PID 5048 wrote to memory of 2364 5048 AcroRd32.exe RdrCEF.exe PID 5048 wrote to memory of 2364 5048 AcroRd32.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 5048 wrote to memory of 2364 5048 AcroRd32.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 4336 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe PID 2504 wrote to memory of 3884 2504 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\双语翻译版.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FC4A7730DF21E390BF6DC0843982DE4F --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A8F66B5A6E0567C9844E4B12554D6D50 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A8F66B5A6E0567C9844E4B12554D6D50 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2527F00A2509681EA6F75D0CCFE1FF62 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2527F00A2509681EA6F75D0CCFE1FF62 --renderer-client-id=4 --mojo-platform-channel-handle=2056 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=13EDBD6EBDE80C6C84225DAE51C5AB15 --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CD2BE586C6D2545FA967355700C20990 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=58D5E3D4A7F6FAE21F4E34C92D36F99C --mojo-platform-channel-handle=1996 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1020-151-0x0000000000000000-mapping.dmp
-
memory/2324-143-0x0000000000000000-mapping.dmp
-
memory/2364-133-0x0000000000000000-mapping.dmp
-
memory/2504-132-0x0000000000000000-mapping.dmp
-
memory/3884-138-0x0000000000000000-mapping.dmp
-
memory/4220-148-0x0000000000000000-mapping.dmp
-
memory/4336-135-0x0000000000000000-mapping.dmp
-
memory/4764-154-0x0000000000000000-mapping.dmp