Analysis
-
max time kernel
138s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 18:39
Behavioral task
behavioral1
Sample
virussign.com_3c6ad0c7b87082fb5736c4df03a66810.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
virussign.com_3c6ad0c7b87082fb5736c4df03a66810.pdf
Resource
win10v2004-20240508-en
General
-
Target
virussign.com_3c6ad0c7b87082fb5736c4df03a66810.pdf
-
Size
110KB
-
MD5
3c6ad0c7b87082fb5736c4df03a66810
-
SHA1
8d0380a949e7714aa958180cb76a3e43a0b7bd97
-
SHA256
07c7fe11e036520054c3040bae52bf0a628178a49e6faceef292d0f90c790b40
-
SHA512
7658db268702aa59d2efc06e98c52f5ea407201ae0fbd835bbfe2a1ce7e640851646332c0bfc4bb7457eb7abdef61ba418fba5660a24db61db88dedb444876d6
-
SSDEEP
1536:MlsRt7i5pJT7SCgsq0/dEeahjm0/jnaemCBmjz7hMJRjXjZmnfhw8jQYdoXpD2:MO5i56CLq0pahjnvBmH7mrjZmf/Q+ok
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1116 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1116 AcroRd32.exe 1116 AcroRd32.exe 1116 AcroRd32.exe 1116 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1116 wrote to memory of 5052 1116 AcroRd32.exe 90 PID 1116 wrote to memory of 5052 1116 AcroRd32.exe 90 PID 1116 wrote to memory of 5052 1116 AcroRd32.exe 90 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 3684 5052 RdrCEF.exe 93 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94 PID 5052 wrote to memory of 4488 5052 RdrCEF.exe 94
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\virussign.com_3c6ad0c7b87082fb5736c4df03a66810.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4DE8F26301AEE4EC351E1D1A49012569 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3684
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C5DC32C8111AACE4B40135FC0CE62EB3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C5DC32C8111AACE4B40135FC0CE62EB3 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:4488
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36E65DBD957AF55D715B97D7F0F6E9F7 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3756
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1E71EC8795B459F65807CDF82D3FF975 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1E71EC8795B459F65807CDF82D3FF975 --renderer-client-id=5 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:13⤵PID:2340
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A19A4893BADE2C1F47F7F5FC385B820 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2932
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE855EFAEF36C9BD4AC245261B8987C5 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2744
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5cdaaba398d2d04f57e0262770973e44c
SHA194d2b20689b1ab8cc9a82eff21fbd53a69c103d5
SHA25660a386ea9128efffa82eb41353cdfa0e8b607a9817c9093d4b99631d248d1844
SHA5127bca2a9dfc73eac22b6ead2c733bba2f8fafd17dc5e0f0489138ea28af2bb61e1bff627defc5883048a9f73a35816f1e85912d49067fae1ce151ba1bb2f3c1eb
-
Filesize
64KB
MD584712d5629693cbbe91ca34e86bfa8b5
SHA17722b47376ecd95ade3c4d5cceec3b34199cacd7
SHA2566225ca3267e02bb40aeb7abef1f551b0958da443374fd8716db348109d5e2138
SHA51243f6a4974f31697fc621f6c98c538e2b6ec293586c042745c296b1330ebcb5ea345408c67a02410f515d7474e27ca34fce371324ee0f1aa96fe761dd9ebdc81e