Analysis
- max time kernel
160s - max time network
181s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
05/01/2024, 11:15
Behavioral task
behavioral1
Sample
438a363ba55140c3a439b322f0afc8dd.pdf
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
438a363ba55140c3a439b322f0afc8dd.pdf
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
- Target 438a363ba55140c3a439b322f0afc8dd.pdf
- Size 1KB
- Sample240105-ncsfjabch2
- SHA256 6ddc05a6427948be0351aa99d2c6110b7c182e06093aa5c1f7c80cdf955479a3
- MD5 438a363ba55140c3a439b322f0afc8dd
- SHA1 a64ee76462400d9af3dbbfb2dabd1aaddb8b1329
- SHA512 33147c6bb32357c0bdccc170fd233479b439acd7d3281c6b1abfb1ed3ca0e3a27f15d65d27f839de11568b2344f3b5ff0187254ae9ae129221cd4a040d59bd76
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\438a363ba55140c3a439b322f0afc8dd.pdf"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3224