Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2022, 18:00
Behavioral task
behavioral1
Sample
attachment20220906-13473-1jkb4t1.pdf
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20220906-13473-1jkb4t1.pdf
Resource
win10v2004-20220901-en
6 signatures
150 seconds
General
-
Target
attachment20220906-13473-1jkb4t1.pdf
-
Size
13KB
-
MD5
807b20cafcc48015dce101a39951be4d
-
SHA1
bd0dafa34f92b5b01cf90709d523b813899a3afa
-
SHA256
5632e5b318e8697da0bae6c891955da93df4e71b21ba9fac9f40b1515238ec27
-
SHA512
38e3e018d400b686ebd4335837274391c5499f8120d2b411b090a1ec7201b7ce749d40500f42c1e7a0c3c28a26984bddc5ea6b9421409e4652627f0382a86fa8
-
SSDEEP
384:ZV6/w+1ElnvRQQS7PG5ZwhGM+rL6U9Ow+p:ZVyZE8guT+r2UkwY
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 5076 2348 AcroRd32.exe 83 PID 2348 wrote to memory of 5076 2348 AcroRd32.exe 83 PID 2348 wrote to memory of 5076 2348 AcroRd32.exe 83 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 3836 5076 RdrCEF.exe 84 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85 PID 5076 wrote to memory of 840 5076 RdrCEF.exe 85
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\attachment20220906-13473-1jkb4t1.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DB05BE1A3AC0DEDC54670C14DF2392CE --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3836
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4D47F5F0D2C34E164632547A324F3936 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4D47F5F0D2C34E164632547A324F3936 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:840
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5D4DFA0E22173B86B144AB2897BDDC35 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5D4DFA0E22173B86B144AB2897BDDC35 --renderer-client-id=4 --mojo-platform-channel-handle=2188 --allow-no-sandbox-job /prefetch:13⤵PID:1212
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=791E8E6FEB902417892B67D645DB2E8A --mojo-platform-channel-handle=2428 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1184
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FBA19123AE847C1DCD12D7031485A2DA --mojo-platform-channel-handle=2684 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4740
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=95F608F812DB3CC85A11A940EE234686 --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:636
-
-