Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 18:29
Behavioral task
behavioral1
Sample
8f948f50_OpenFileToGetAccount30004302041006b.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8f948f50_OpenFileToGetAccount30004302041006b.pdf
Resource
win10v2004-20240508-en
General
-
Target
8f948f50_OpenFileToGetAccount30004302041006b.pdf
-
Size
129KB
-
MD5
32a79ed56dbf7ecc65abf1062b762ee1
-
SHA1
2c36cbc7a6823d3a8b69db6160c512423f2ea1bc
-
SHA256
cc92078bde5bf55bf773a55e0b1ab784eff6835e73536bb9be740addbd7ec880
-
SHA512
50eabbc5bfb4a7c0e08390bffcaf72142bb9f462aa3a1d34d4091264a1ad1d1fe3f739d345f1d10fba31fc88cfb9b76525beb4e4b1e9857ea88c4f9cc6770a71
-
SSDEEP
1536:ibsZteviem9NOT8WbUPmo7kq5ZKtvE4IQTPvQrZT2GouxsBzPFSN9xNJ8z:ibMteqD6UPPQq5ZIftPKyGgZSvx/8z
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1260 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 1260 AcroRd32.exe 1260 AcroRd32.exe 1260 AcroRd32.exe 1260 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1260 wrote to memory of 1444 1260 AcroRd32.exe RdrCEF.exe PID 1260 wrote to memory of 1444 1260 AcroRd32.exe RdrCEF.exe PID 1260 wrote to memory of 1444 1260 AcroRd32.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 1632 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe PID 1444 wrote to memory of 3708 1444 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8f948f50_OpenFileToGetAccount30004302041006b.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A953B36D404B21167E007D026F43E02E --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F89FE15F8BD282BE73F51AD4645DCCE0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F89FE15F8BD282BE73F51AD4645DCCE0 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F9936DB16C0E3D029C376F84D53C3D03 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F4EACFDBE50EDDA8E6BA9ACFA1EB6C41 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F4EACFDBE50EDDA8E6BA9ACFA1EB6C41 --renderer-client-id=5 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=562994D424D5354C58A9D1D81E43639B --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=25A8D55625F00D7CF3C11E0A820AB817 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD5d2d05f72c6760dd8857b65d873b7a452
SHA1cd3b395138c7bed450ce402bb1697c19c26ada8b
SHA256dd86ce05438e46afed06aad70781080b9a51af6045994885fe82d6bc089daf4a
SHA512cd61ea895ba7425f83f9a855641a5834a4348e1102e4425f49609cbb879a76abbe7be824b6a145bccac0dffa37ef1f783013c17b5b9df154ab96fd24709abfcd
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD5c8e8e569ce329873031337a6f4a07859
SHA16085e0a87e98377549522279947e6a07493a1e97
SHA256d7ae3883eb9bbdd03473b4feeda4f28ec663cd4855665644215e4d1a06105c71
SHA512f4026e33846768bc26f6016f10196dfed273a585476bb7426ea37e7e72f60bac0322d60f469dcf8e1ae8954811639d37d03da7321a8327c0a60d609d20a68d53