Analysis
-
max time kernel
160s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
11/06/2023, 16:08 UTC
Static task
static1
Behavioral task
behavioral1
Sample
httpsrec.netstatsrooms.pdf
Resource
win10-20230220-en
5 signatures
1200 seconds
Behavioral task
behavioral2
Sample
httpsrec.netstatsrooms.pdf
Resource
win10v2004-20230220-en
6 signatures
1200 seconds
General
-
Target
httpsrec.netstatsrooms.pdf
-
Size
90KB
-
MD5
f0243ef69be9740770a162fc524066cb
-
SHA1
7d0b6575ca3ce69859949f5747a3ffa7b83c57dc
-
SHA256
1fc5517e1eb4f11fed7255e50863e8c5a5886baf4ca6a8a8081121d63070748b
-
SHA512
2de91595ddaf9d3fa23e478012a25cc488b00b9dc0d38d105aa1a1116a9cf7934a067c650b7bb6606c2faf4862f745e6f4cd9bea713effc3e8d45421f5b1be08
-
SSDEEP
1536:IsUWk17PTz3JEIqtddVLLbAcUSMMyiWyovcFZP79EhkWNUC9g8Nxqb7vDWYqbh7:IRWk17PTz3JEIqtddVLLbAcU4fRosZPo
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3840 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3840 AcroRd32.exe 3840 AcroRd32.exe 3840 AcroRd32.exe 3840 AcroRd32.exe 3840 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3840 wrote to memory of 4352 3840 AcroRd32.exe 66 PID 3840 wrote to memory of 4352 3840 AcroRd32.exe 66 PID 3840 wrote to memory of 4352 3840 AcroRd32.exe 66 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\httpsrec.netstatsrooms.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6AC6EE567AC3B2AD3C1D309FF5E29501 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2096
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=25FE0C34EDE9FCEA027B083050D2EE03 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=25FE0C34EDE9FCEA027B083050D2EE03 --renderer-client-id=2 --mojo-platform-channel-handle=1652 --allow-no-sandbox-job /prefetch:13⤵PID:2172
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C9DA692621860BD89D22D540943884CE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C9DA692621860BD89D22D540943884CE --renderer-client-id=4 --mojo-platform-channel-handle=2220 --allow-no-sandbox-job /prefetch:13⤵PID:4040
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B81EA89C6590E972D8E05D9EA9880240 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3084
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=53BDB53B4B7F1FEBED8D25186B97FB9E --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:68
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6DF6E4E5205DA33E84F2F3C6A87D4551 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4392
-
-
Network
-
Remote address:8.8.8.8:53Request135.112.223.173.in-addr.arpaIN PTRResponse135.112.223.173.in-addr.arpaIN PTRa173-223-112-135deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request83.121.18.2.in-addr.arpaIN PTRResponse83.121.18.2.in-addr.arpaIN PTRa2-18-121-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request62.13.109.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request1.202.248.87.in-addr.arpaIN PTRResponse1.202.248.87.in-addr.arpaIN PTRhttps-87-248-202-1amsllnwnet
-
74 B 141 B 1 1
DNS Request
135.112.223.173.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.121.18.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
62.13.109.52.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
1.202.248.87.in-addr.arpa