Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2024 07:32
Behavioral task
behavioral1
Sample
7c8592d7741fb6419c94494c4b2a593e.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7c8592d7741fb6419c94494c4b2a593e.pdf
Resource
win10v2004-20231215-en
General
-
Target
7c8592d7741fb6419c94494c4b2a593e.pdf
-
Size
3KB
-
MD5
7c8592d7741fb6419c94494c4b2a593e
-
SHA1
51980425b2c065c054fe1a3f35160470ff3dac7d
-
SHA256
b98c3706f80cfcab09b30f3d7a9519d4be2bd08c7c7dc53fa96403466722317f
-
SHA512
1ef61f7c24650f363e930c9b626a056fbcef9e571e07005276304b1ba88af35e3272b33fca1515cc652ece2f20d6b28e4151b020fffaf7dff04ccf875d3ea512
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 4068 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe 4068 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 4068 wrote to memory of 4872 4068 AcroRd32.exe RdrCEF.exe PID 4068 wrote to memory of 4872 4068 AcroRd32.exe RdrCEF.exe PID 4068 wrote to memory of 4872 4068 AcroRd32.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2156 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 3660 4872 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7c8592d7741fb6419c94494c4b2a593e.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AE91AC636C139C78E8E6E7B96FEABA9F --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2156
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D63B95A78163623DCA4B600C6F0BBC50 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D63B95A78163623DCA4B600C6F0BBC50 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:3660
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E9C4B22E69C3CF65CFCBF6AA03413B5C --mojo-platform-channel-handle=2184 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3936
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=006C3721DA067739062E96090434D200 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=006C3721DA067739062E96090434D200 --renderer-client-id=5 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job /prefetch:13⤵PID:912
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FFC0F3640F62A92264B7CA76D5FCF9F6 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3988
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3C26CC6C3D4FA4F3CC196ACAFE6C3BDF --mojo-platform-channel-handle=2136 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54b9886ebc97b657fbcf7777c119e6022
SHA198b7cb046f4ff9f9cca9e3605bdb8c5804f90d86
SHA25614f12feab6a2daad6aab8895a26febacbcae70e9fca56eb7de01643dd1d22c0d
SHA5123d60f58064fea3b269ed24fe21c35c3081add738b7427b0f3c6d13d4538715c97c5367f26e7a7782c094b6dbebf255ea3a58918060cbaafb4b0b9736884d1885
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
34KB
MD54a09663fe738323fbce73412e238dd96
SHA1c35606aebdef8ca41c04a1b2efc9a801f4c5be45
SHA256d51b33f80a988cb8bbb027428c4305a1e9853a7d5b3862f6cb8b813ccb9cdc6a
SHA51221c6d3618bd70db7feba14aefd9720e9994e87455c5ad14ef227aa9a30055c9f8cd23dcbfd6d19ef4141994d5937e13b6fa3331e665e1f3e688a438ae3243fe4