Analysis
-
max time kernel
159s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2023, 10:34
Behavioral task
behavioral1
Sample
08684640c22bf6d57371f57620e95743.pdf
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
08684640c22bf6d57371f57620e95743.pdf
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
08684640c22bf6d57371f57620e95743.pdf
-
Size
80KB
-
MD5
08684640c22bf6d57371f57620e95743
-
SHA1
9a0bc39679ad95886a6baa25cf0ec3637a8f3dfb
-
SHA256
14d42209a514331947683e651277aedaf45f3eb708820e4dbbac5672815420c3
-
SHA512
f5e56af1a502a5fe9d03e1bec99c2c29a8b8ebeb419d89aae775e76eb639aa88136de3eb78e48716b61bffa35058c21eacc5088cc04cb153248905190acc4638
-
SSDEEP
1536:q4bWwheEW95VpmGpUwkwjJqDvIASBywYoWOpOwrKWyBcFjNFTt0Y:HWwYE6VpmGpXkwVqDvBwYlwrSyFt
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2668 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2668 AcroRd32.exe 2668 AcroRd32.exe 2668 AcroRd32.exe 2668 AcroRd32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1808 2668 AcroRd32.exe 95 PID 2668 wrote to memory of 1808 2668 AcroRd32.exe 95 PID 2668 wrote to memory of 1808 2668 AcroRd32.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08684640c22bf6d57371f57620e95743.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:1808
-