Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2023, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
Nový textový dokument.txt.vs
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Nový textový dokument.txt.vs
Resource
win10v2004-20230220-en
General
-
Target
Nový textový dokument.txt.vs
-
Size
43B
-
MD5
dc8a33c9e7bc143facd1fba3ff81c20a
-
SHA1
0840d1cd2ed03714c765b297f831bdea6d56956c
-
SHA256
b29f9f6f7cff2de77f57efad229da6879e7efff691f9e3d8b2c684a0aa0dba1b
-
SHA512
3f65e0e76f275d7d8acbaa965158cfb50db34cdb0accfa97f55af01d643b8c5906191f655d6f2f08de70c2125dfe5f5849152ed472fc671ba26e0dc861ff0d34
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4004 OpenWith.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4004 OpenWith.exe 4732 AcroRd32.exe 4732 AcroRd32.exe 4732 AcroRd32.exe 4732 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 4732 4004 OpenWith.exe 96 PID 4004 wrote to memory of 4732 4004 OpenWith.exe 96 PID 4004 wrote to memory of 4732 4004 OpenWith.exe 96 PID 4732 wrote to memory of 3304 4732 AcroRd32.exe 98 PID 4732 wrote to memory of 3304 4732 AcroRd32.exe 98 PID 4732 wrote to memory of 3304 4732 AcroRd32.exe 98 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 844 3304 RdrCEF.exe 99 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100 PID 3304 wrote to memory of 1236 3304 RdrCEF.exe 100
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Nový textový dokument.txt.vs"1⤵
- Modifies registry class
PID:2640
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nový textový dokument.txt.vs"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7587D7CEC4496D76E68FC881AC6F4779 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:844
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EF4B1B07E7FCA1D57F5B7DCE53ED6E3C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EF4B1B07E7FCA1D57F5B7DCE53ED6E3C --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:14⤵PID:1236
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FAA7B382E43BC540B950B7D12443E92F --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4948
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E85C930DBF9028555ADB71944B029679 --mojo-platform-channel-handle=1696 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2112
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2142F3257AF43D02223B6CF8A9606FC5 --mojo-platform-channel-handle=2388 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3948
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:436