Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 05:16
Behavioral task
behavioral1
Sample
7072b01ad97906c3263aec888b898e5e.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7072b01ad97906c3263aec888b898e5e.pdf
Resource
win10v2004-20231215-en
General
-
Target
7072b01ad97906c3263aec888b898e5e.pdf
-
Size
35KB
-
MD5
7072b01ad97906c3263aec888b898e5e
-
SHA1
2822b7aa3255a3bb114b02437da4d3c9307188e7
-
SHA256
970e904f3117b9eba451fd9e1b6b74fab0c09d979e17d4d9d199c7051d3e5b5e
-
SHA512
1feb1f272da89e511d918bd6dee73b6af08856f779a894eea93d934affd2990d6b45175b8b40b4bbe1ef329ae99da9506036a4865e6d64eee3e686d833e96d9d
-
SSDEEP
768:n8PIDafgocUJr7o7z5fRuPvZMQXNrK2kv72kSNG5Kb0tz0Dm7K6Orrorh:t/F4AAItoDNBrErh
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 836 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 2668 836 AcroRd32.exe 93 PID 836 wrote to memory of 2668 836 AcroRd32.exe 93 PID 836 wrote to memory of 2668 836 AcroRd32.exe 93 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 2368 2668 RdrCEF.exe 95 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94 PID 2668 wrote to memory of 1684 2668 RdrCEF.exe 94
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7072b01ad97906c3263aec888b898e5e.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0FFB2FA492B238C7EAC2A666F734E1E8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0FFB2FA492B238C7EAC2A666F734E1E8 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:1684
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5D4A3D3A0FD06B286DE6ADE5857AAAB1 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2368
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=409BE49117D748779D06E3DCE2A4D25D --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:532
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6E7D6295B4C86B577C4EA4AEB8CB9BD6 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4544
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2F3916F04A8EB7A48BD1BAA1A5328638 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3136
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E8950AFBEC0E928127CA89D5D14A0C45 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E8950AFBEC0E928127CA89D5D14A0C45 --renderer-client-id=7 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job /prefetch:13⤵PID:4328
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5a606bde03848d1a3d804e2deda12b441
SHA177ee06df688e5ef75fbb1d458c37efe19a504faa
SHA2566a6d1ac1c2371a87b96f915c8f5d6d9138f11ca38d9849a2889ecd8f7f2a6d57
SHA512a5d092fde1219cbc0903ded9e380c85164dc66ba9a30f9370912681a99d5c07e950a3ce202222987d38dde7722c1ab89fabe15288f63df0b56e99e10c9bc879a
-
Filesize
4KB
MD59576fd1ceba7466f85e118c718d0f090
SHA1483cc10e930b4b47f744568a4fe851af35f8ab50
SHA2567ae1ae1c1d7d7265cfa7704356e1607b35bb86e414b9d39cee17a474dbf3e348
SHA512ad1bd7eb5c0508ab41432a890f506f5911945b6537668949e6afd454ff683c23915bde713217e2391c5f0fe60f4c9b45c13fa4f056985598b6b99597afdb46a7
-
Filesize
14KB
MD55b60c91d61b36dee34c6c21ac8c19031
SHA11b5859e30987a24ad988f7123290df77c5455be3
SHA256e02302130487d236d94e0e4ebd4075eebb72526e8c5d5fe6907a92ca20ee0875
SHA51212f0238734fefa550970ee623516bc1dfd4c201f7ca685734083a4e22f8cba8bb7a107be643b0e0948269a1477d933e5724b28390fea91844fe09d0c36642571