Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2023, 01:30
Behavioral task
behavioral1
Sample
69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf
Resource
win10v2004-20220812-en
General
-
Target
69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf
-
Size
595KB
-
MD5
3a78a1d2a3ffe445c00d05da7f70e789
-
SHA1
69391fec373f9a060a4cb31c54e95b0295f8d7fb
-
SHA256
a67ddd4adf27d7bbbaf0eb910717061d3cddc86b90cfca383bed6626fbb2a711
-
SHA512
14442d8d10a4593db5ab9a070a1af559d5bf6abf141659223911f830f7753b36f9a837ceecc7784618d61eff61dfa57a1b99e4d50bdf556859b7df5614686fe4
-
SSDEEP
12288:C6tKIfnmcQxHisY1Ut8BkXpCw/Ctgk3f61+VCrmWklA:CefZQJi51lBkXUw61vY+ErWlA
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3256 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe 3256 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3256 wrote to memory of 3440 3256 AcroRd32.exe 78 PID 3256 wrote to memory of 3440 3256 AcroRd32.exe 78 PID 3256 wrote to memory of 3440 3256 AcroRd32.exe 78 PID 3256 wrote to memory of 3536 3256 AcroRd32.exe 79 PID 3256 wrote to memory of 3536 3256 AcroRd32.exe 79 PID 3256 wrote to memory of 3536 3256 AcroRd32.exe 79 PID 3256 wrote to memory of 2296 3256 AcroRd32.exe 82 PID 3256 wrote to memory of 2296 3256 AcroRd32.exe 82 PID 3256 wrote to memory of 2296 3256 AcroRd32.exe 82 PID 3256 wrote to memory of 4040 3256 AcroRd32.exe 85 PID 3256 wrote to memory of 4040 3256 AcroRd32.exe 85 PID 3256 wrote to memory of 4040 3256 AcroRd32.exe 85 PID 3256 wrote to memory of 3132 3256 AcroRd32.exe 86 PID 3256 wrote to memory of 3132 3256 AcroRd32.exe 86 PID 3256 wrote to memory of 3132 3256 AcroRd32.exe 86 PID 3256 wrote to memory of 5060 3256 AcroRd32.exe 87 PID 3256 wrote to memory of 5060 3256 AcroRd32.exe 87 PID 3256 wrote to memory of 5060 3256 AcroRd32.exe 87 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 3320 5060 RdrCEF.exe 90 PID 5060 wrote to memory of 4668 5060 RdrCEF.exe 91 PID 5060 wrote to memory of 4668 5060 RdrCEF.exe 91 PID 5060 wrote to memory of 4668 5060 RdrCEF.exe 91 PID 5060 wrote to memory of 4668 5060 RdrCEF.exe 91 PID 5060 wrote to memory of 4668 5060 RdrCEF.exe 91
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\69391fec373f9a060a4cb31c54e95b0295f8d7fb.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:3440
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:3536
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:2296
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4040
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:3132
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7DC4ABF62434D4CEF806B58ED87C25B9 --mojo-platform-channel-handle=1652 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3320
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9153E6A283A2966C1C8EB1D253A42231 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9153E6A283A2966C1C8EB1D253A42231 --renderer-client-id=2 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job /prefetch:13⤵PID:4668
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4039D380C4F607ED5858C7766668C843 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4039D380C4F607ED5858C7766668C843 --renderer-client-id=4 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:13⤵PID:1304
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C2A4E3EFAA270777EF7B57B69F2E3A83 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4716
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0CBDE0E593DC4AD399DB0B9796BDFE75 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3368
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C0F7210903ED5032C1B3A9A9CA036C20 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1844
-
-