35aa37e589b0a265e0c86cce1d83b761cc999fece18011eeff9ad727022d6619

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2023, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dostępność i pilne zapytanie o cenę.gz
Size

47KB
MD5

d01b36674e1e173bbed14e23fed0d782
SHA1

229164534c8616241dc16090f9c0a25ee79a32fb
SHA256

35aa37e589b0a265e0c86cce1d83b761cc999fece18011eeff9ad727022d6619
SHA512

d211a9e682065000616e1a36bfcae827de9ff350a28bdccd23c0fdec4e8fa42a89ad34a13a0474cbd4e54aa65b799a8f391ef3b75847dfbbcca7cd392100d353
SSDEEP

768:jROCjk3Isgm8mTaX8g4rTAE3C0exzzjgKizbN9ia5FGdCoP4HU1NKjFQc0:jRO73mMTaX8tTAGeViXia54dC2vKmB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.gz\ = "gz_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\헴韣Ȁ耀v	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\헴韣Ȁ耀v\ = "gz_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\gz_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\gz_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.gz	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\gz_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\gz_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\gz_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	OpenWith.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
3812	AcroRd32.exe
3812	AcroRd32.exe
3812	AcroRd32.exe
3812	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3812	4676	OpenWith.exe	91
PID 4676 wrote to memory of 3812	4676	OpenWith.exe	91
PID 4676 wrote to memory of 3812	4676	OpenWith.exe	91
PID 3812 wrote to memory of 3992	3812	AcroRd32.exe	94
PID 3812 wrote to memory of 3992	3812	AcroRd32.exe	94
PID 3812 wrote to memory of 3992	3812	AcroRd32.exe	94
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1876	3992	RdrCEF.exe	95
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96
PID 3992 wrote to memory of 1608	3992	RdrCEF.exe	96

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dostępność i pilne zapytanie o cenę.gz"
1⤵
- Modifies registry class
PID:2456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dostępność i pilne zapytanie o cenę.gz"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35397892C6FCFDB03D366DC7103AA0FD --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F9E13B78B75325B4DE0FA3BA4BAA9E9A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F9E13B78B75325B4DE0FA3BA4BAA9E9A --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7D718084AFD80C1BFF8E6209C610395D --mojo-platform-channel-handle=2164 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=534F43842A468937B1E2F237A8B07401 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6F3213462D4990F02A7786A127BC5C54 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads