Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
80s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/12/2022, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
DocumentsFolder_23961250_12202022.pdf
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
DocumentsFolder_23961250_12202022.pdf
Resource
win10v2004-20220812-en
General
-
Target
DocumentsFolder_23961250_12202022.pdf
-
Size
119KB
-
MD5
36c5a509dabcb295d9b9f49712103568
-
SHA1
267e6dc57c058925a2cd80b1de209acb15e26fe8
-
SHA256
9541aaf893e165086ead368bd21f766a45780f70c71dcb661a7afb82c1d6503f
-
SHA512
fe8239042fae24b9b1481c2473e218324f08cfe149cdd82f30e878cbac3c06b4197f7791c84d226e4c4679ed4994e00f6aef61c9dca5c0bf4bab43d2323e8e28
-
SSDEEP
3072:SW1bn6f+kzllQ8aEB0VTZ7m7x2evc4obfMYkZaN:SObnQQ8qVl7mMevc4efVTN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2140 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 4828 2140 AcroRd32.exe 80 PID 2140 wrote to memory of 4828 2140 AcroRd32.exe 80 PID 2140 wrote to memory of 4828 2140 AcroRd32.exe 80 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 3948 4828 RdrCEF.exe 83 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84 PID 4828 wrote to memory of 4040 4828 RdrCEF.exe 84
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DocumentsFolder_23961250_12202022.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AE11C6D2CD04690CBEF9CECCE56A8B5C --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3948
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F979A58C155B094BB576BE4798BF3C72 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F979A58C155B094BB576BE4798BF3C72 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:4040
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9F4382BCCE0A61F490BF10989797C2F1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9F4382BCCE0A61F490BF10989797C2F1 --renderer-client-id=4 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:13⤵PID:3664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=695596DDB1E5916D222683307E95FD7E --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3840
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ED7430E0A0A70982A33AC98E1CF48EDC --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:396
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=70CBF4154EA9F2FBE34FDDE3336C1F1C --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2520
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2244