Analysis
-
max time kernel
19s -
max time network
30s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 14:52
Behavioral task
behavioral1
Sample
6446c42cf7a62f9d3cecc39578a4d18d350d00371a01cc424c700b0cbf8083f9.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6446c42cf7a62f9d3cecc39578a4d18d350d00371a01cc424c700b0cbf8083f9.pdf
Resource
win10v2004-20220812-en
General
-
Target
6446c42cf7a62f9d3cecc39578a4d18d350d00371a01cc424c700b0cbf8083f9.pdf
-
Size
550KB
-
MD5
6fbf46390aef7b26fe5e7dd44e7f3455
-
SHA1
de3f76ac6cfa0a335043230fbdbe51d39aae2784
-
SHA256
6446c42cf7a62f9d3cecc39578a4d18d350d00371a01cc424c700b0cbf8083f9
-
SHA512
2005889cbb5c1787dddc1d8f215c01da0e8674629adfb8bdbb9704c29489a8d547fac31091778cbb0032ac84b242cfde92d0b2f0ddda7aba9227538899c3b2a5
-
SSDEEP
12288:6LX3ak5mT8t3X0ZoYhSa3Mkvmj3YJt7/A8v/z:Sn5mAGPhz3Mk+joJtTAY
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 1508 AcroRd32.exe 1508 AcroRd32.exe 1508 AcroRd32.exe 1508 AcroRd32.exe 1508 AcroRd32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
AcroRd32.exedescription pid process target process PID 1508 wrote to memory of 1632 1508 AcroRd32.exe RdrCEF.exe PID 1508 wrote to memory of 1632 1508 AcroRd32.exe RdrCEF.exe PID 1508 wrote to memory of 1632 1508 AcroRd32.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6446c42cf7a62f9d3cecc39578a4d18d350d00371a01cc424c700b0cbf8083f9.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1632-132-0x0000000000000000-mapping.dmp