Analysis
-
max time kernel
11s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2022 21:29
Behavioral task
behavioral1
Sample
bdaa9fb65b0763506cb785858b922e1164d5005a4863c62cf986772b7abeecb2.pdf
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bdaa9fb65b0763506cb785858b922e1164d5005a4863c62cf986772b7abeecb2.pdf
Resource
win10v2004-20220812-en
General
-
Target
bdaa9fb65b0763506cb785858b922e1164d5005a4863c62cf986772b7abeecb2.pdf
-
Size
550KB
-
MD5
17eeedaea5a8af674ad3dd5f5c503ea6
-
SHA1
d1f71e1a949a93c2a64d668593572b16dfe3a853
-
SHA256
bdaa9fb65b0763506cb785858b922e1164d5005a4863c62cf986772b7abeecb2
-
SHA512
8b1653131db1181be90e6e3cf0ad96978c51b5b78f0dd1cac5c549fd99d7fadaae0e24e7c7f277d581fb7e9703ef8ef036a29f0f927090e013e4c07a36583318
-
SSDEEP
12288:6LX3ak5mT8t3X0ZoYhSa3Mkvmj3YJt7/A8v/E:Sn5mAGPhz3Mk+joJtTAn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 4872 AcroRd32.exe 4872 AcroRd32.exe 4872 AcroRd32.exe 4872 AcroRd32.exe 4872 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bdaa9fb65b0763506cb785858b922e1164d5005a4863c62cf986772b7abeecb2.pdf"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4872