19fdf48e152cb0e13871fac8e3f436da5675d4326911b38d1a882578e5e12391

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02bfe34bea55e327cfdead9cff215f33.pdf
Size 155KB
Sample240206-cvjessdba8
SHA256 0567f3a1d0b439731f0d559695c53aa79883bb26f28b25d1f3ceca33a819721e
MD5 02bfe34bea55e327cfdead9cff215f33
SHA1 ffbc01a9f1c4614ed88069c262014d0fadf1bf78
SHA512 0cc560161609f0f6aebc585d25a45bc0a8c0e0504198bfcd0184e6891e8186761e998b2e10b19cdf4634044adc1f37fa5af77eb33a2a3a93b0ed923165aa6c65
SSDEEP 1536:XSRgaaC+Z6ZVZOpOmvrf2llGUk6loSGnSJMqxso+NQ08XQfLHW49d:1FcSOYmCSJMq+enJi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	3016	WerFault.exe	27

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3016	AcroRd32.exe
3016	AcroRd32.exe
3016	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2540	3016	AcroRd32.exe	28
PID 3016 wrote to memory of 2540	3016	AcroRd32.exe	28
PID 3016 wrote to memory of 2540	3016	AcroRd32.exe	28
PID 3016 wrote to memory of 2540	3016	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\02bfe34bea55e327cfdead9cff215f33.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 1100
  2⤵
  - Program crash
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads