Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2023, 19:21
Behavioral task
behavioral1
Sample
69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf
Resource
win10v2004-20220812-en
General
-
Target
69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf
-
Size
595KB
-
MD5
3a78a1d2a3ffe445c00d05da7f70e789
-
SHA1
69391fec373f9a060a4cb31c54e95b0295f8d7fb
-
SHA256
a67ddd4adf27d7bbbaf0eb910717061d3cddc86b90cfca383bed6626fbb2a711
-
SHA512
14442d8d10a4593db5ab9a070a1af559d5bf6abf141659223911f830f7753b36f9a837ceecc7784618d61eff61dfa57a1b99e4d50bdf556859b7df5614686fe4
-
SSDEEP
12288:C6tKIfnmcQxHisY1Ut8BkXpCw/Ctgk3f61+VCrmWklA:CefZQJi51lBkXUw61vY+ErWlA
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1180 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe 1180 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 1172 1180 AcroRd32.exe 80 PID 1180 wrote to memory of 1172 1180 AcroRd32.exe 80 PID 1180 wrote to memory of 1172 1180 AcroRd32.exe 80 PID 1180 wrote to memory of 4852 1180 AcroRd32.exe 83 PID 1180 wrote to memory of 4852 1180 AcroRd32.exe 83 PID 1180 wrote to memory of 4852 1180 AcroRd32.exe 83 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 3432 1172 RdrCEF.exe 84 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85 PID 1172 wrote to memory of 4388 1172 RdrCEF.exe 85
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A765B1DD2A9A856B069AF9B8F49C9C58 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A765B1DD2A9A856B069AF9B8F49C9C58 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:3432
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=51BEB41CBC0B38BA10F45DB3FB38FBFB --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4388
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4CC25EC9021F82791576CAC049A6D6FB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4CC25EC9021F82791576CAC049A6D6FB --renderer-client-id=4 --mojo-platform-channel-handle=2156 --allow-no-sandbox-job /prefetch:13⤵PID:2584
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=94C9B139A88006EE0F877C48AC39D0F9 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3396
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C77B8F6BEA8C17E8C600CA9E5E2BE5A4 --mojo-platform-channel-handle=2692 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3420
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=66621CD50FA80B77C668100800F9F614 --mojo-platform-channel-handle=2588 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3700
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4852
-