Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
855d595c48a8f5e592f0267eb7bfbcfa621ce0d06a1dec6e14e6515ad804e794.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
855d595c48a8f5e592f0267eb7bfbcfa621ce0d06a1dec6e14e6515ad804e794.pdf
Resource
win10v2004-20220812-en
General
-
Target
855d595c48a8f5e592f0267eb7bfbcfa621ce0d06a1dec6e14e6515ad804e794.pdf
-
Size
380KB
-
MD5
c2d6b6830cde6f7f08059396732ac7bb
-
SHA1
8c5c6d4cc9f8d2410779cf705f64d838ab7a2cb6
-
SHA256
855d595c48a8f5e592f0267eb7bfbcfa621ce0d06a1dec6e14e6515ad804e794
-
SHA512
cb9a3cfb2b4896411956752d7bf4d2719e4ba302cf7b51e67d3e3d949195cf170e628e56016558aeaaf8a6afc035ab8879b65458d94c9866911f36f3b1a88e67
-
SSDEEP
6144:Mj3sE/hBJGyogLNBRso+v2lbW9e0+/EHzhN0f8R4HLsoLVjiYahXtE0xDlJ:MrN5Bzlbx0+MHbK88Lm/XtrxDlJ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1756 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe 1756 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 4712 1756 AcroRd32.exe 80 PID 1756 wrote to memory of 4712 1756 AcroRd32.exe 80 PID 1756 wrote to memory of 4712 1756 AcroRd32.exe 80 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 4632 4712 RdrCEF.exe 83 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84 PID 4712 wrote to memory of 3980 4712 RdrCEF.exe 84
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\855d595c48a8f5e592f0267eb7bfbcfa621ce0d06a1dec6e14e6515ad804e794.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7AC3EEADD5B0DB62AB668350256D3292 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4632
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CAB2AF2354BC898B8D01BAEB5A906D5F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CAB2AF2354BC898B8D01BAEB5A906D5F --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:13⤵PID:3980
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=262FD1FEA32112B50A5FCB6955692796 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:452
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8EFA493CEA83E6ED216889B8B55C0F29 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8EFA493CEA83E6ED216889B8B55C0F29 --renderer-client-id=5 --mojo-platform-channel-handle=2140 --allow-no-sandbox-job /prefetch:13⤵PID:4312
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3FB82C8679CBEC4346E1F30CFC776782 --mojo-platform-channel-handle=2424 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4760
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=85E372922459A3CDC9793AC92E863569 --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3440
-
-