Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
02/11/2022, 07:35
221102-jeqmhaaca2 602/11/2022, 07:27
221102-jak68aabg7 102/11/2022, 07:14
221102-h2phaaabc6 602/11/2022, 07:10
221102-hzkrbaaba8 6Analysis
-
max time kernel
61s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2022, 07:27
Static task
static1
Behavioral task
behavioral1
Sample
23adb09c91783fa30d2be70048efa52dd20ebd90d7cc0c33ed4a91b0fb3020d1.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
23adb09c91783fa30d2be70048efa52dd20ebd90d7cc0c33ed4a91b0fb3020d1.pdf
Resource
win10v2004-20220812-en
General
-
Target
23adb09c91783fa30d2be70048efa52dd20ebd90d7cc0c33ed4a91b0fb3020d1.pdf
-
Size
123KB
-
MD5
5beb7c5ff96ef2dc04a9819c202b763c
-
SHA1
da443ec9803434c6889d1ce29b68eba49410077d
-
SHA256
23adb09c91783fa30d2be70048efa52dd20ebd90d7cc0c33ed4a91b0fb3020d1
-
SHA512
07d180e2def2e3deda4f8b473ad8ff1dc9e2a86535f26b03c6d2322a2eca4a06732ca64d051494380027493cd5c2b1e4252f3261af66d53e9d4b192b60785af7
-
SSDEEP
3072:CCiI2W/+oGlhxbRg5NpmqeBAmizCXNse6+rACvt2cq2p0FVbO7LcCDOrdUx07+:CW/+oGfk3mEmizuNse6SACvt2cSVbO7p
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4612 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe 4612 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4616 4612 AcroRd32.exe 84 PID 4612 wrote to memory of 4616 4612 AcroRd32.exe 84 PID 4612 wrote to memory of 4616 4612 AcroRd32.exe 84 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 268 4616 RdrCEF.exe 87 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88 PID 4616 wrote to memory of 224 4616 RdrCEF.exe 88
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\23adb09c91783fa30d2be70048efa52dd20ebd90d7cc0c33ed4a91b0fb3020d1.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=34B23809A4CD62B6ABFC98DA4E37A762 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:268
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A6044AE1EB2039DA037F1B60624ECF27 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A6044AE1EB2039DA037F1B60624ECF27 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:13⤵PID:224
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2B20C7E63969A197552539B6439E17FC --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4552
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D2383D779472E0E4C338397FE4D63B69 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D2383D779472E0E4C338397FE4D63B69 --renderer-client-id=5 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:13⤵PID:4600
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C1CBB09C0BEFABE30DDA528DC2850183 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1244
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9FC33412CDA3840472A1F08F4F1DECBA --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4372
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4632