Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3sddp-17.2....up.zip
windows10-1703-x64
1SddpReleas...ng.pdf
windows10-1703-x64
1SddpReleas...sp.pdf
windows10-1703-x64
1SddpReleas...or.pdf
windows10-1703-x64
1changelog.txt
windows10-1703-x64
1online-changelog.url
windows10-1703-x64
7sddp-17.2....up.exe
windows10-1703-x64
7Resubmissions
09/05/2023, 17:51
230509-wfk5mafb5t 809/05/2023, 17:46
230509-wb98ysfb3x 708/05/2023, 22:53
230508-2vgcwaeh8s 7Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
09/05/2023, 17:46
Behavioral task
behavioral1
Sample
sddp-17.2.4rc1-setup.zip
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
SddpReleaseNotesEng.pdf
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
SddpReleaseNotesEsp.pdf
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
SddpReleaseNotesPor.pdf
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
changelog.txt
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
online-changelog.url
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
sddp-17.2.4rc1-setup.exe
Resource
win10-20230220-en
General
-
Target
SddpReleaseNotesEng.pdf
-
Size
895KB
-
MD5
a0e2cf42cb8f5726cd59f4b6f5eaa09e
-
SHA1
5df433bf47b7fa59621b50153ffea56c96a0b9e8
-
SHA256
84e8bc1bf9878c8dc6203d990439fbfd643029209d6fcfa9e6c4eacd05864e65
-
SHA512
e10f93838e45d28d674128e32eab94f7832cded807c69589fb8bd8faa01469e0238d8e3343e00b9552a18226e350aafa006968042ff87812122dc5854f02d06b
-
SSDEEP
24576:HcKVwLLX4pCrPsWZMrnQfJ6oqUF1Wx/Ff:8KV4XuitZe2J69b/Ff
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2488 AcroRd32.exe 2488 AcroRd32.exe 2488 AcroRd32.exe 2488 AcroRd32.exe 2488 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2816 2488 AcroRd32.exe 66 PID 2488 wrote to memory of 2816 2488 AcroRd32.exe 66 PID 2488 wrote to memory of 2816 2488 AcroRd32.exe 66 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 4888 2816 RdrCEF.exe 67 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68 PID 2816 wrote to memory of 3816 2816 RdrCEF.exe 68
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SddpReleaseNotesEng.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B425B6A616495FD9E9BFE617640D4E17 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B425B6A616495FD9E9BFE617640D4E17 --renderer-client-id=2 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job /prefetch:13⤵PID:4888
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E654F5800E3D211B871226F57C1E107D --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3816
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B6F412063634EE2C36A061A427024D2D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B6F412063634EE2C36A061A427024D2D --renderer-client-id=4 --mojo-platform-channel-handle=2216 --allow-no-sandbox-job /prefetch:13⤵PID:3760
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3C58C48094A949D57838576C7691E4E0 --mojo-platform-channel-handle=2496 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3588
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EF392C178BE3E70A5CF8EB4C5863C8E0 --mojo-platform-channel-handle=2036 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2612
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=22C29C7AD9D2F4D800C01699B17898EF --mojo-platform-channel-handle=2516 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4508
-
-