Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
22/09/2023, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
5051_file_stateless_paper.pdf
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5051_file_stateless_paper.pdf
Resource
win10v2004-20230915-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
5051_file_stateless_paper.pdf
-
Size
4B
-
MD5
0b497b33b1a05057bc1634e607170bf6
-
SHA1
149ecfc76f45c53fadcc1843df6755d4ae25aa2a
-
SHA256
55f6a88dc02579e8f6f191ee9ec91f66067b5d362434877cfbc325e4bf23aef1
-
SHA512
d5e5ddf7a6ac7001680d2387a05f2d7006281d693d41165be9f6bb4e1db717b6532b27e40fac8db35733e31f80e442a745033fdd1b4a2f07f1daa5e4d75b1242
Score
1/10
Malware Config
Signatures
-
Modifies registry class 31 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewVersion = "0" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616193" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_Classes\Local Settings AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 AcroRd32.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff AcroRd32.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2532 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2532 AcroRd32.exe 2532 AcroRd32.exe 2532 AcroRd32.exe 2532 AcroRd32.exe 2532 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5051_file_stateless_paper.pdf"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54d6be727043d341ad451196c0ab90907
SHA166f0260bb25a5813dc6303e987fa3c2c3099f900
SHA25652094f2f429fe740e0a13791b58471780a5b507a079a173d1e97707a67d3629a
SHA5127d485a661449982bfe540a1fdcd93f872b3bde95aec4749bc77b60db4b7f09cccdde132a20d9021a9fb5eeb40e758ff5bd072c5060af478c668dd9757e103451