d2488876c357eaa6e2e62da628c38c6fa40afa66480c5d691c14a35fa9abc67c

Analysis

max time kernel
153s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16d1890204c86d31a6cc74b326ffeb65.pdf
Size

32KB
MD5

16d1890204c86d31a6cc74b326ffeb65
SHA1

1ddac467f8601fc5e30842806e707d61b3bfd4fc
SHA256

d2488876c357eaa6e2e62da628c38c6fa40afa66480c5d691c14a35fa9abc67c
SHA512

90769e074c635e2d4153c433d79930e9e8db8fa409e19981160cd229ff5309fd73896f47490ca4caf286ddbf027881c795daedfc5959c92a52b01c630ad5805f
SSDEEP

384:iVClV9i7Ji5r5m5y7jXAS4khb8nADEV6y4qC5i3eCUSWP9TSSh7oFEru1TzTuvXQ:iIlV9CJomwfXAYhg4RXNtd4EcEguvrdi

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2228	AcroRd32.exe
2228	AcroRd32.exe
2228	AcroRd32.exe
2228	AcroRd32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2948	2228	AcroRd32.exe	107
PID 2228 wrote to memory of 2948	2228	AcroRd32.exe	107
PID 2228 wrote to memory of 2948	2228	AcroRd32.exe	107
PID 2228 wrote to memory of 4392	2228	AcroRd32.exe	108
PID 2228 wrote to memory of 4392	2228	AcroRd32.exe	108
PID 2228 wrote to memory of 4392	2228	AcroRd32.exe	108

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\16d1890204c86d31a6cc74b326ffeb65.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:2948
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads