37472b761f44b4b8956858716a45b3a5ba3c393b1de01f4cb6d3e40f92ea12ba

Resubmissions

27/06/2024, 23:04

240627-22fd6azanj 3

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37472b761f44b4b8956858716a45b3a5ba3c393b1de01f4cb6d3e40f92ea12ba_NeikiAnalytics.pdf
Size

79KB
MD5

257ab5485cedb94fe66fd361620a53a0
SHA1

618fa3bdc375f326d619b854e263bafadc03a9fb
SHA256

37472b761f44b4b8956858716a45b3a5ba3c393b1de01f4cb6d3e40f92ea12ba
SHA512

8ea661ace9163d6e665400a180f3806eb4dd56c7ed62ea8a4fa2ea602169986f48bb68b0d52e435a0af8618abc7eba9c6597135e414d1fe1fbbb2f37455f50bf
SSDEEP

1536:SXrVzr3HUWXD+PXCgtilIdEoFZmROM57yk61KabA4o8DfD:mrV8Wq7IToHYn7yk61FbY8H

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4844	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4844	AcroRd32.exe
4844	AcroRd32.exe
4844	AcroRd32.exe
4844	AcroRd32.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\37472b761f44b4b8956858716a45b3a5ba3c393b1de01f4cb6d3e40f92ea12ba_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...