Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 23:06
Static task
static1
Behavioral task
behavioral1
Sample
2966420537915NIKG.pdf
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2966420537915NIKG.pdf
Resource
win10v2004-20230703-en
General
-
Target
2966420537915NIKG.pdf
-
Size
26KB
-
MD5
1948f5d42aa4699d9fa5cf614e59fb11
-
SHA1
f496c9d2589f9a4c2c3b68a012e7ff56d1efc0ed
-
SHA256
0bd03f34680481827bd0ad2f06d5302986de08ed43789184c5708170d3ba252c
-
SHA512
bd1d39541fc05065693de7cd2ccd768c660526891ee92efe3764a8bc55398fb9937a2a6e46b034257be1bd053d2289cac908d8595e9ea2418392d75bb92907c5
-
SSDEEP
768:YFqHSD8HSZprkfr5i4ACr/qdzE5hWf7auYd+:9HSZp8dgKGzQh6++
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4576 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe 4576 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4576 wrote to memory of 2608 4576 AcroRd32.exe 87 PID 4576 wrote to memory of 2608 4576 AcroRd32.exe 87 PID 4576 wrote to memory of 2608 4576 AcroRd32.exe 87 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 2496 2608 RdrCEF.exe 88 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89 PID 2608 wrote to memory of 4560 2608 RdrCEF.exe 89
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2966420537915NIKG.pdf"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8EB532AD18C3793AE98C61497DD89DD3 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2496
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4210E8F071F070E22AE52877C746A528 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4210E8F071F070E22AE52877C746A528 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:13⤵PID:4560
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7C6DB46686A54C6C7F19BFE7A02E74E --mojo-platform-channel-handle=2148 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3972
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=78BA8BC01ABB243293A27FE4DA59EC07 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=78BA8BC01ABB243293A27FE4DA59EC07 --renderer-client-id=5 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job /prefetch:13⤵PID:2600
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3C643C195517DE4B9CF01D810E38D847 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4656
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A4EE05E62FDFB9B70097627D604BAE52 --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4964
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5983013cfce84fb12dfcc8ea20fa8f859
SHA141d2b86042ead802998773e089bcc9a631e835f0
SHA2560776707669638ba77cca0620b193aa8b8657fe0e768fb0d98d85089dd167b321
SHA5121b22063b11c3ea78bfc8c0de658f69a2a408862072ae3dd13b1b73f48db61997b2376438baf12498a7a50c60c8c8ceac2c3110866d074ca0e2f8fa27c58306bb
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5