Analysis
-
max time kernel
50s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 14:24
Static task
static1
Behavioral task
behavioral1
Sample
adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe
-
Size
1.2MB
-
MD5
d182ad4757d763b78b3c2aaa4cf73a34
-
SHA1
64c16c9e208479da264518a6d0ea9930de544f09
-
SHA256
8267bc0f07e64a7552bd50c3722189a8b816d0b3f8600f2b5adf45d97fe65157
-
SHA512
ebe62855755dff1efa98f12291c7ada2a3ec67c90e81a691e86628a1e4211e45a040d2ebddba8134f92e7b477412e8aaf5de8a04436c82b9cd61fe1f731baab7
-
SSDEEP
24576:3AIjJ+e0bURnfR3v6TTF/BUIsBEBGjrxIoMuAIZJ2ndsyHdU+MXyt:3l4e06nZAjQBvhIIyndsy94G
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4692 taskmgr.exe Token: SeSystemProfilePrivilege 4692 taskmgr.exe Token: SeCreateGlobalPrivilege 4692 taskmgr.exe Token: 33 4692 taskmgr.exe Token: SeIncBasePriorityPrivilege 4692 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
pid Process 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5028 adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe 5028 adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe 5028 adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe 5028 adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe"C:\Users\Admin\AppData\Local\Temp\adobe-acrobat-reader-dc-windows-2023.008.20555-33733.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5028
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4692