Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 22:56
Behavioral task
behavioral1
Sample
1f272e3fafd6d3ef42a88901923ce64c.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1f272e3fafd6d3ef42a88901923ce64c.pdf
Resource
win10v2004-20231222-en
General
-
Target
1f272e3fafd6d3ef42a88901923ce64c.pdf
-
Size
89KB
-
MD5
1f272e3fafd6d3ef42a88901923ce64c
-
SHA1
9fbbff71ca9d22f62ecbd1ed301f11e38dceae6f
-
SHA256
fde2e7daa027ee3ce9b6a1b0f590ebb882d33cb7398de96f86ec1344e2f99a9f
-
SHA512
1358ab3e3d866f0c669f31ad19539b1d2ac7efccc0d7dfdfa27778fa0f5dfd43901b88a4c018dfcca441295fa94ec37810d6d190609491689a4d0d3e8babea30
-
SSDEEP
1536:FQg7NhpzltrS6S78yuvnWkdMbig1Eqxy5DVtM54WypOlWWxkfIulqzLfoym:ag7NzPrSYyD4ujEqU1VtM55lDkfIulA6
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5628 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe 5628 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5628 wrote to memory of 1284 5628 AcroRd32.exe 91 PID 5628 wrote to memory of 1284 5628 AcroRd32.exe 91 PID 5628 wrote to memory of 1284 5628 AcroRd32.exe 91 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 1824 1284 RdrCEF.exe 93 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92 PID 1284 wrote to memory of 984 1284 RdrCEF.exe 92
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1f272e3fafd6d3ef42a88901923ce64c.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C54F59F5D664563C12B5DE11FC20E858 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C54F59F5D664563C12B5DE11FC20E858 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:984
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D92BDB12CC3C5988ED40E5A9344E2535 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1824
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=524DCDD88ACD441F6A190B3D7A8F72F0 --mojo-platform-channel-handle=2268 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2720
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8063BEBA8BCADDBFEC1E523D3117D783 --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4932
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=049952FBDA7429E69A426D9AAB3F8E37 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4980
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2E892E9C4CDE6933F5696BE0AB347C62 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2E892E9C4CDE6933F5696BE0AB347C62 --renderer-client-id=8 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job /prefetch:13⤵PID:436
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6048