Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
11/06/2023, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
httpsrec.netstatsrooms.pdf
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
httpsrec.netstatsrooms.pdf
Resource
win10v2004-20230220-en
General
-
Target
httpsrec.netstatsrooms.pdf
-
Size
90KB
-
MD5
f0243ef69be9740770a162fc524066cb
-
SHA1
7d0b6575ca3ce69859949f5747a3ffa7b83c57dc
-
SHA256
1fc5517e1eb4f11fed7255e50863e8c5a5886baf4ca6a8a8081121d63070748b
-
SHA512
2de91595ddaf9d3fa23e478012a25cc488b00b9dc0d38d105aa1a1116a9cf7934a067c650b7bb6606c2faf4862f745e6f4cd9bea713effc3e8d45421f5b1be08
-
SSDEEP
1536:IsUWk17PTz3JEIqtddVLLbAcUSMMyiWyovcFZP79EhkWNUC9g8Nxqb7vDWYqbh7:IRWk17PTz3JEIqtddVLLbAcU4fRosZPo
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3840 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3840 AcroRd32.exe 3840 AcroRd32.exe 3840 AcroRd32.exe 3840 AcroRd32.exe 3840 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3840 wrote to memory of 4352 3840 AcroRd32.exe 66 PID 3840 wrote to memory of 4352 3840 AcroRd32.exe 66 PID 3840 wrote to memory of 4352 3840 AcroRd32.exe 66 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2096 4352 RdrCEF.exe 67 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68 PID 4352 wrote to memory of 2172 4352 RdrCEF.exe 68
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\httpsrec.netstatsrooms.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6AC6EE567AC3B2AD3C1D309FF5E29501 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2096
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=25FE0C34EDE9FCEA027B083050D2EE03 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=25FE0C34EDE9FCEA027B083050D2EE03 --renderer-client-id=2 --mojo-platform-channel-handle=1652 --allow-no-sandbox-job /prefetch:13⤵PID:2172
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C9DA692621860BD89D22D540943884CE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C9DA692621860BD89D22D540943884CE --renderer-client-id=4 --mojo-platform-channel-handle=2220 --allow-no-sandbox-job /prefetch:13⤵PID:4040
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B81EA89C6590E972D8E05D9EA9880240 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3084
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=53BDB53B4B7F1FEBED8D25186B97FB9E --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:68
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6DF6E4E5205DA33E84F2F3C6A87D4551 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4392
-
-