0bb0ac901543232e376aa104d4a6b5d6a96e268f6ad8da2c66c9aec2bd5d83f9

Analysis

max time kernel
16s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2022 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bb0ac901543232e376aa104d4a6b5d6a96e268f6ad8da2c66c9aec2bd5d83f9.pdf
Size

54KB
MD5

45848600a61336181ff66896ecd4df0c
SHA1

dd64f160724dfd42335757858a825c28a07d42bd
SHA256

0bb0ac901543232e376aa104d4a6b5d6a96e268f6ad8da2c66c9aec2bd5d83f9
SHA512

62e5c7ad6b444507c7cfb4294c43be8d0c76753713fc61f4484bbdb17dfc9dce63102868070cc3de303b971252a351874a5ef453c4d93dbb9b0ec4889f2c5d86
SSDEEP

768:eymIZ2nkpzsqF4tFzpJxJ+3Hd3SgcRN2FeWB8baOKC1xPvk8PNEEsJvtJ5txEpuE:S4ts5AiRki5xo7t62kjjT

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4248 AcroRd32.exe
4248 AcroRd32.exe
4248 AcroRd32.exe
4248 AcroRd32.exe

pid	process
4248	AcroRd32.exe
4248	AcroRd32.exe
4248	AcroRd32.exe
4248	AcroRd32.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0bb0ac901543232e376aa104d4a6b5d6a96e268f6ad8da2c66c9aec2bd5d83f9.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4248

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads