Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 16:12
Behavioral task
behavioral1
Sample
7bb266cf21b8414c67946524001d2897.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7bb266cf21b8414c67946524001d2897.pdf
Resource
win10v2004-20231215-en
General
-
Target
7bb266cf21b8414c67946524001d2897.pdf
-
Size
80KB
-
MD5
7bb266cf21b8414c67946524001d2897
-
SHA1
e552f1afb43f2d4f111276cd92d5d170b9d90818
-
SHA256
e48e2b0cb43e08f170b61d52f2033ea628b9cc575a2117b6f29f36928e127f91
-
SHA512
68156d85c0dff0073033fd60a6125d7503c23b47fc940c7881f8a166e054f30ece7818fb4bfddcb982ee076e2ad25d775602c247dca5b0d33e48a754c50393b9
-
SSDEEP
1536:pzUgg+Fvw2A5stC6zn3tG+VHu0Uni8OIj/n90owWGpOKu/nQWiWevt8FBSPFbDWr:JrlWifnnDwi8plFKu/nayFBCaas8s
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4536 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe 4536 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4536 wrote to memory of 2100 4536 AcroRd32.exe 91 PID 4536 wrote to memory of 2100 4536 AcroRd32.exe 91 PID 4536 wrote to memory of 2100 4536 AcroRd32.exe 91 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 1780 2100 RdrCEF.exe 92 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93 PID 2100 wrote to memory of 4080 2100 RdrCEF.exe 93
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7bb266cf21b8414c67946524001d2897.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A2B4F53E05C2D0EBDB5F6CDE28D3B4A8 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1780
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9C60C6FB92DA75BFF1BEBAEFF74931FD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9C60C6FB92DA75BFF1BEBAEFF74931FD --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:4080
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8ED3D167543659EF4DEDD3D55D4C8BBB --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4300
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=46D9CBF7AEA1E8394B5C65AD341AC314 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3400
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7436A2F21AC3589C2D8B1F65D2AD8CF7 --mojo-platform-channel-handle=2496 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4856
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=119DD2D95E269EC91475E03F9CC67EBA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=119DD2D95E269EC91475E03F9CC67EBA --renderer-client-id=7 --mojo-platform-channel-handle=2532 --allow-no-sandbox-job /prefetch:13⤵PID:4144
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD531477bd6bd1147baa7e8105ad10590ba
SHA1f55182c085383c154ce23f234da7b863d857ab74
SHA2561269a5ef539208d2c9e194553709db55d9bc847d6dea0b8f9a64eb3315c5e783
SHA512bfe4792f5fe1375b4b58f81dbed3fd47399f193a16e8797ca013a62bf31ac93d922b75c9be35ee484a1bd44918b947b1344865b0b20a649ab5f49be6f26c4d7f
-
Filesize
56KB
MD5c26ed30e7d5ab440480838636efc41db
SHA1c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591
SHA2566a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef
SHA51296cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df