Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2022, 09:06
Behavioral task
behavioral1
Sample
d8e76ac72a9897b2ec3cef3468518d4899ab709d53d7855e216965bb97083e6a.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d8e76ac72a9897b2ec3cef3468518d4899ab709d53d7855e216965bb97083e6a.pdf
Resource
win10v2004-20220812-en
General
-
Target
d8e76ac72a9897b2ec3cef3468518d4899ab709d53d7855e216965bb97083e6a.pdf
-
Size
1.7MB
-
MD5
c6f42ebc1247416ffacf1325e916a6ec
-
SHA1
87f706bef8f44d824833a28318f9f0961820af0d
-
SHA256
d8e76ac72a9897b2ec3cef3468518d4899ab709d53d7855e216965bb97083e6a
-
SHA512
ee48006358970f0aeeed5faa364dd8d699e63637006a3a2865801b6203191296a61858e60baa86a557acf10948466de99efe76d186aa463b744741b8fcf95b6d
-
SSDEEP
49152:DIPai1KKKKKKKKKKKKKKKKKKKKKK1IbzVAmmmDbQzI6VaHhOhmhLnheyDGZEw:MD1KKKKKKKKKKKKKKKKKKKKKK1IH3Q0i
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 4264 2080 AcroRd32.exe 82 PID 2080 wrote to memory of 4264 2080 AcroRd32.exe 82 PID 2080 wrote to memory of 4264 2080 AcroRd32.exe 82 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 5092 4264 RdrCEF.exe 86 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87 PID 4264 wrote to memory of 2996 4264 RdrCEF.exe 87
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d8e76ac72a9897b2ec3cef3468518d4899ab709d53d7855e216965bb97083e6a.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A751BFDD41177B9C4BE7432B6D2BB194 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5092
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A8F66635ABFC9E9D34697D1A605B4818 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A8F66635ABFC9E9D34697D1A605B4818 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:13⤵PID:2996
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=312031EF624688AB38A5C8FC3A04C49C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=312031EF624688AB38A5C8FC3A04C49C --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:13⤵PID:1580
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE7561C55E728167603AEB92EBCB7C62 --mojo-platform-channel-handle=1840 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4868
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B272710D6A1FA4068DA56E696A0F269B --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4632
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=232553EB2F1F638525068492F9540DA1 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:64
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:3416
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5048