895782ca2e7a9fb44815a4d26d9779db35c032c14569fbd66bb9fc97b85ad8a6

General

Target
PLAN%20DE%20TRESORERIE.pdf
Size 3.1MB
Sample260929-w82cbadb95
SHA256 895782ca2e7a9fb44815a4d26d9779db35c032c14569fbd66bb9fc97b85ad8a6
MD5 b6d13fe53b80fde21dffdd76dda69bec
SHA1 4bfe047a33216d1d1acfe893abd98a5a9b738a4f
SHA512 4709967422236013047454d3cb4db04040ba6f34c975309d63fddb3e7152bf03de8d9202a7fb8a5396b45e6a74a1b5998c441ecde908a34d885ec72561558e25
SSDEEP 98304:fS8Ozh3Thmf3xUoYIIiTiDQi/NCj/6YHIyHDib/W03/aSR:qxzwTisiVCSb+GbR
TLSH
T140E523F613758D5CE4DB9231CB5CB89613A5303325E11E33351F69922CAC8A72E58B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe
5752	AcroRd32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 4232	5752	AcroRd32.exe	89
PID 4232 wrote to memory of 1316	4232	AdobeCollabSync.exe	90
PID 1316 wrote to memory of 5640	1316	AdobeCollabSync.exe	91

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PLAN%20DE%20TRESORERIE.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4232
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 bc69700be8dae2138af4e09daa5cd42517edd3c4d0a9482a74b10b2f425030aa
MD5 57064386b6c1f245b1a604c493ef6056
SHA1 40fdf98eba91d95f7b0a287f4bca3c886f5ddb55
SHA512 b66eea7b43d3f7559b29f6b08d453c25b2e0a05fc773d618b850ef15cdb081c9b688ab3305088f04ee23805f83a33db0dfc872cfb981ab61264b7067f79333c4
SSDEEP 192:6+oGsTzoU27NTaUxmFX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:6klNCX44UNlNaN
TLSH
T13093FF0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 096f9b7defe5d011a5bb5f4231c32e7fa0f2c75697148381441325ae17cb61c3
MD5 687c2ee8d142cc6fba2141f4ceacb8dd
SHA1 3be8aa16190e9e1847c3eae26784c228a4535180
SHA512 dd41485c8c9496139783eeb2e1e5f715a695f8d4a3140bb5c1023eef1ce27c98bda3db31f0410d258abe994b41a0a3946655ae034706405a9c990b65a1fb652f
SSDEEP 192:K+oGsTzoU27NTaUxmyX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNVX44UNlNaN
TLSH
T169930F0F3556F261C5A896B4814084F3119EBF1BE7E6F1A392B2CD3F16F9643012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 639a37846c693d92cf4671c7baf4d48b31358b154d6dd783b98a6ed10a82b7b0
MD5 24b433d20ca6f02ebe855c08cbfe6f44
SHA1 ab0dbfe382d9825c753e15d6b980157d8eb1417b
SHA512 c3417a3b48fb1b4a6228c85dca444b2979a4e7bfc3e002f94400ac440b06f56380e836ec4adefec9e6f9800827727e0837181c18e06e3b1eb1cea35a7aa726da
SSDEEP 192:a+oGsTzoU27NTaUxmGTHlX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPTFX44UNlNaN
TLSH
T103930E0F2556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9743112DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 4.3MB
SHA256 e0e555342fa61a9d746aa6f2aba5899ff9e6268010c4213fd46a2d131806c2bb
MD5 dfbb3e2e9799cdfb49f90e2e27ca31c2
SHA1 6e093f38572e85693f6530e3140cb1509cfda8df
SHA512 1d3a32f22efb60428ab6084bf9a5ef1ac99c6a2e9d41465c37906dc6211bb7983a1307ac648d7e4c0ae001bedd61bf90569da6d7836109485d25683212ee80ef
SSDEEP 98304:jedlPe28cd4ceOyCLVFLmx3mifuSWS94DK1o+ErEM40MAbCM+pdHrlIKj:jOecgOyoL6H94+/n0MAOM+XJ9j
TLSH
T1F52633BD57256849C49B80B311E6B67946B03A3A30CB6F4EF9CC7291B32EDC67311687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads