Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2022, 08:55
Behavioral task
behavioral1
Sample
75724ced6a6cbe5188cf1dd8f3728ab0852116897496f5adf49c81a747883907.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
75724ced6a6cbe5188cf1dd8f3728ab0852116897496f5adf49c81a747883907.pdf
Resource
win10v2004-20220901-en
General
-
Target
75724ced6a6cbe5188cf1dd8f3728ab0852116897496f5adf49c81a747883907.pdf
-
Size
530KB
-
MD5
980c8aee2b1c27c8376a4575b760aa45
-
SHA1
6b10eb6ce9adff1382eecb9d6a5344046bbcde9e
-
SHA256
75724ced6a6cbe5188cf1dd8f3728ab0852116897496f5adf49c81a747883907
-
SHA512
cd085df39ec2ee5e39c2b8d41536b832e4f4064271364e6b643ec0ecb50c6d840afb86d2a40cff4f290c388b141a0f9e46d597f9a42507de05b2c6b6c2bc7342
-
SSDEEP
12288:MRNCXyRXg6uDghX7oGe0DSkl1T5E41Xeb+1VlIeK+3:aRXg6u8hxRM41vVWz+3
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5016 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe 5016 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5016 wrote to memory of 2252 5016 AcroRd32.exe 84 PID 5016 wrote to memory of 2252 5016 AcroRd32.exe 84 PID 5016 wrote to memory of 2252 5016 AcroRd32.exe 84 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 2248 2252 RdrCEF.exe 86 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87 PID 2252 wrote to memory of 4440 2252 RdrCEF.exe 87
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\75724ced6a6cbe5188cf1dd8f3728ab0852116897496f5adf49c81a747883907.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=38095D662B9176DEB68987DCB3C47234 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2248
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=391A29CE9E738D357E2F1E6830612F13 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=391A29CE9E738D357E2F1E6830612F13 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:13⤵PID:4440
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=976DD65523F8659727D1E3452A74D55D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=976DD65523F8659727D1E3452A74D55D --renderer-client-id=4 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:13⤵PID:4216
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6067A12FA8F2569967311B29C4EDFBBD --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3440
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1E020A82318FBEB009CA9EA52A5AEBDC --mojo-platform-channel-handle=2780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2852
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EBC5353F985BD0C9404B22CA668D0941 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3876
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4380