Analysis
-
max time kernel
10s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 12:22
Behavioral task
behavioral1
Sample
476ef15d5087372366c75cd90c4273f30a68fe0c2b45e9364f433a4b1006cda7.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
476ef15d5087372366c75cd90c4273f30a68fe0c2b45e9364f433a4b1006cda7.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
original.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
original.exe
Resource
win10v2004-20220812-en
General
-
Target
476ef15d5087372366c75cd90c4273f30a68fe0c2b45e9364f433a4b1006cda7.pdf
-
Size
1.1MB
-
MD5
7a208767406d312039a46c3d064ea91d
-
SHA1
2709390630cd9639b662eae7b2c394d4f8fbcaad
-
SHA256
476ef15d5087372366c75cd90c4273f30a68fe0c2b45e9364f433a4b1006cda7
-
SHA512
76fae9748eb563d6423eb274580982fa3ab4630055bde09de0c20e7fc39b41e83bbf368ae7d0a983b1080920ffeaefd94331e900cbcc66b84040ca68e9f7be56
-
SSDEEP
24576:RPyxomNXIRty8yGObkT6xu8OyvzSyJXgk6bOY2XJf:I1Nu8JGAZtVJb1RJf
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 4172 AcroRd32.exe 4172 AcroRd32.exe 4172 AcroRd32.exe 4172 AcroRd32.exe 4172 AcroRd32.exe 4172 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\476ef15d5087372366c75cd90c4273f30a68fe0c2b45e9364f433a4b1006cda7.pdf"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx