Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 01:15
Behavioral task
behavioral1
Sample
47a5d7a482f98d2c747b37988ec15639.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
47a5d7a482f98d2c747b37988ec15639.pdf
Resource
win10v2004-20231215-en
General
-
Target
47a5d7a482f98d2c747b37988ec15639.pdf
-
Size
98KB
-
MD5
47a5d7a482f98d2c747b37988ec15639
-
SHA1
347dba356d58a6007cb5c1e3511a30775ec3e153
-
SHA256
c7911806916d591cdfdd82e1ddbcafdccfd7e663e63d6d7f081ff376968935ac
-
SHA512
6aa63315c2559c63799a3f53461a5cc20e6d4362f21b5f1c305f48d2400d92a9f214c06efd559c009ad21e32804bfddded3061e842f91ce07d7d31f4f78b2036
-
SSDEEP
3072:qE0+OzzV71YQkYRZMGSdWUA/7UqmOa2aP6KpX:3IF71YziaGiWUeUTlr
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1064 AcroRd32.exe 1064 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1064 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1064 AcroRd32.exe 1064 AcroRd32.exe 1064 AcroRd32.exe 1064 AcroRd32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1064 wrote to memory of 1540 1064 AcroRd32.exe 105 PID 1064 wrote to memory of 1540 1064 AcroRd32.exe 105 PID 1064 wrote to memory of 1540 1064 AcroRd32.exe 105 PID 1064 wrote to memory of 2712 1064 AcroRd32.exe 108 PID 1064 wrote to memory of 2712 1064 AcroRd32.exe 108 PID 1064 wrote to memory of 2712 1064 AcroRd32.exe 108 PID 1064 wrote to memory of 4304 1064 AcroRd32.exe 109 PID 1064 wrote to memory of 4304 1064 AcroRd32.exe 109 PID 1064 wrote to memory of 4304 1064 AcroRd32.exe 109
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\47a5d7a482f98d2c747b37988ec15639.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:1540
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:2712
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e