Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2022, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
0b95a80aac60f0b9106cb11a3c172d247c4cacf4c5e45af463ca7f4ee2adce06.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b95a80aac60f0b9106cb11a3c172d247c4cacf4c5e45af463ca7f4ee2adce06.pdf
Resource
win10v2004-20220901-en
General
-
Target
0b95a80aac60f0b9106cb11a3c172d247c4cacf4c5e45af463ca7f4ee2adce06.pdf
-
Size
5.2MB
-
MD5
4f8db8121b3e97fd3d4d6e6b1cbc82b6
-
SHA1
bf36c8a40b4dcaaaf28ec2874fb9fa83eefc88db
-
SHA256
0b95a80aac60f0b9106cb11a3c172d247c4cacf4c5e45af463ca7f4ee2adce06
-
SHA512
e1fba4b6b3aff7ef90c8ebfde0bf946a3b03e3990d75567f8f7796ea5018bab74520e0bb8eb83ac29a6322a635caac94a8a991269127b1a633fc41ef9f50d9e2
-
SSDEEP
98304:Msv3p6aArSm6aI8mVGfrLTFi09KwS4KBKfq9JTcYQ938aDMYMX6VIFbFU4:MgDuS16frLxhXyKf0AYKXYYMXuI/
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe 4972 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 3944 4972 AcroRd32.exe 86 PID 4972 wrote to memory of 3944 4972 AcroRd32.exe 86 PID 4972 wrote to memory of 3944 4972 AcroRd32.exe 86 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 3176 3944 RdrCEF.exe 88 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89 PID 3944 wrote to memory of 1520 3944 RdrCEF.exe 89
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0b95a80aac60f0b9106cb11a3c172d247c4cacf4c5e45af463ca7f4ee2adce06.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E51029FE7EF1B05C303FE5999D20E0D8 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3176
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=48BB21DB50A66075206245D3AF0F4843 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=48BB21DB50A66075206245D3AF0F4843 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:13⤵PID:1520
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D007840F07183F326A820DCB37290786 --mojo-platform-channel-handle=2148 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3408
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E712200577227BBC3EE67303051AD0EF --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4844
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9E1538555792626B2C3FA7EE8E8B183 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5052
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2440