Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 20:59
Behavioral task
behavioral1
Sample
03db402c153268ad386c8f376bd28393.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
03db402c153268ad386c8f376bd28393.pdf
Resource
win10v2004-20231215-en
General
-
Target
03db402c153268ad386c8f376bd28393.pdf
-
Size
35KB
-
MD5
03db402c153268ad386c8f376bd28393
-
SHA1
7e09478c4bddd20f7b346168eb174273b4e2c87e
-
SHA256
93c6bd24a3ca4a9e6a593898024b73762e83e64553ad847753ba4e96865efeb0
-
SHA512
30cb51d9bbde66779582657e4b8ba3b7cd5f6f9e28c9d9c7738b15c086b477cfbc114f420f7493b667d53e8e90a4cc0ab171020268897d962fc7d395218601c4
-
SSDEEP
768:HJMZD/HsFUbs3ms0A4aZY1pXygArK5MpH4YgPEJlllXiNI:CVSUKDxZMpBj5MePuiNI
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5096 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe 5096 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5096 wrote to memory of 2044 5096 AcroRd32.exe 92 PID 5096 wrote to memory of 2044 5096 AcroRd32.exe 92 PID 5096 wrote to memory of 2044 5096 AcroRd32.exe 92 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 872 2044 RdrCEF.exe 95 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96 PID 2044 wrote to memory of 2196 2044 RdrCEF.exe 96
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\03db402c153268ad386c8f376bd28393.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=13815E5B2F95945857C4923F6A8DF1F5 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:872
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=87EE50ABBDDB7B1A75DB2951B9992E4B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=87EE50ABBDDB7B1A75DB2951B9992E4B --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:2196
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CDE26B0CBDBB6131DAA29F2E883BEE6B --mojo-platform-channel-handle=2180 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1052
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4B4A1CB3CC26BC8BF3AF36EC4012F14B --mojo-platform-channel-handle=2424 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3136
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E7D5D69267276B101ACE6D0C0D22B079 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E7D5D69267276B101ACE6D0C0D22B079 --renderer-client-id=6 --mojo-platform-channel-handle=1924 --allow-no-sandbox-job /prefetch:13⤵PID:3856
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CD6AF606346803A67C19EFDC2C8413A2 --mojo-platform-channel-handle=2748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3180
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD543b55f78f8dbc2a13309caf7b6e2488a
SHA11c2f7ce957adac862becd3dc775e81aec7087ba3
SHA256a6daebd9691ec6733a00cb060866cee12421c8734ff07a6f0a6f64b902fc3c7e
SHA512e200099bb50550b4eab3b7de9db0c31177265d12336496e301eac24326e588664aff8204bfe1fde7ee11d845652c9b175f19c901480f9bb0b8592ee2652ad25f
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5