Analysis
-
max time kernel
254s -
max time network
259s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-06-2024 18:58
Behavioral task
behavioral1
Sample
Complete with Docusign [email protected]
Resource
win11-20240611-en
General
-
Target
Complete with Docusign [email protected]
-
Size
43KB
-
MD5
c697193dba2f7d2ed6459a94a0fb77b1
-
SHA1
8265cc86eafaf2725ac08c90b8127f61985fd761
-
SHA256
fbf695d71731f33e7231709829f77a13fa490bc18c574e7fd1183480ee685b39
-
SHA512
8307b34a5e0f7c0c01a9aa0815f95dca216968160316d454f796eab56a5d45f01faa9f0dad95ed965c90a0318b01c7e8def982c52cd596e9b58c0230a0d57dfb
-
SSDEEP
768:KSyIl3RdfcQH+Wq3pU0hS4zNRhOYWmgzN1lLgu5IyQ1pvt8:KM9fcWq3ps6RPAgu5BQfvt8
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2092 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe 2092 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2092 wrote to memory of 916 2092 AcroRd32.exe RdrCEF.exe PID 2092 wrote to memory of 916 2092 AcroRd32.exe RdrCEF.exe PID 2092 wrote to memory of 916 2092 AcroRd32.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 2488 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe PID 916 wrote to memory of 1748 916 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Complete with Docusign [email protected]"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=55B0FD8B0D26809FE01368A61CE6E368 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2488
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=64C386F3249FEAF47024B81D933E94EE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=64C386F3249FEAF47024B81D933E94EE --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:13⤵PID:1748
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=91D7BEBBFE6D87E2F13CE7BC9FC9E599 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=91D7BEBBFE6D87E2F13CE7BC9FC9E599 --renderer-client-id=4 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job /prefetch:13⤵PID:2944
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=071A7E5A4CC8A5A1C614FD6303E7860B --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:764
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=019C84D33E93F41F4E415E008E5569C2 --mojo-platform-channel-handle=1976 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1248
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A1944019E01AA16418657057BD516430 --mojo-platform-channel-handle=2844 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e1803f3199b9dcc10ae345c7a1ebc518
SHA1eb741aee2875fcfd9e582fee780d5a7f81faa24b
SHA2569b469315c27a5cacfa2285b82cf505a0433b3ecd47debc80c1ed5d5b7df1d0ba
SHA51245e03040c7ca8ab6d72a548611dcf5d3dae870f881ffb0106bd0102f1da8fa14eff41fed47191669d8e48f491e03c8b25e7e3e79a21a1bfdeb6c6d13bb868204
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5