Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 04:11
Behavioral task
behavioral1
Sample
0dfec95d9e0af905367e6d8d3eab3dbe.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0dfec95d9e0af905367e6d8d3eab3dbe.pdf
Resource
win10v2004-20231215-en
General
-
Target
0dfec95d9e0af905367e6d8d3eab3dbe.pdf
-
Size
83KB
-
MD5
0dfec95d9e0af905367e6d8d3eab3dbe
-
SHA1
1c1079702870d04c6b4bfa8236f1c7249a402793
-
SHA256
78a0491365a0e94a4c2d7a98669c3929d31f7336364d5a889c66960f0f2cd2b7
-
SHA512
a855e46b7465d855aae22b4ee3d0a2081c2519135fc58d2fa2bc3b46cb9f244234c1a8f364a10f211a98791c33831373d7e45254073e0bdff5aaefc58156203b
-
SSDEEP
1536:f85RZ9zmeoT4Ak+xMDsi2GV8wvPJuN8NJOhWsgk/O52H12uaW0WUpO7D1s:AQRHxAb2nEPd/h5q2uaW37O
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4796 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe 4796 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 3384 4796 AcroRd32.exe 92 PID 4796 wrote to memory of 3384 4796 AcroRd32.exe 92 PID 4796 wrote to memory of 3384 4796 AcroRd32.exe 92 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 1120 3384 RdrCEF.exe 94 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93 PID 3384 wrote to memory of 2216 3384 RdrCEF.exe 93
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0dfec95d9e0af905367e6d8d3eab3dbe.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6C4DC432DC43437238DEC8BD3BBB080E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6C4DC432DC43437238DEC8BD3BBB080E --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:2216
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AF00F2C89EE372F3717732693E167B08 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1120
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=340277B10521371584A5B172251252CC --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1648
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F9FFAA0DE9ED175EF22E92E105DFE26C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F9FFAA0DE9ED175EF22E92E105DFE26C --renderer-client-id=5 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:13⤵PID:3056
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D54B48A2A2AC400B930F8BE16F0663C9 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2992
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=119E7E353923F088C4E28F4DFA858D52 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2432
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ebcd96b306771518f5a8a1ab6abde20e
SHA198de96db994e5abfefaa789d00a7c0f826f581f9
SHA2566a6bc705c6937056b5d2096cab9df50d18e540b1b19fbeb331d8bd403e578e22
SHA512133e1d352aab37076fc87b45c2d9d5cb0ede2c57710591d83472630f3f843d115e48c9e1cfc455201364a7fc6d66860972ea85a464a222565bb0ac5189ec96e7