Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 01:42
Behavioral task
behavioral1
Sample
233055d042fe4504e5339d85ec99e1fc.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
233055d042fe4504e5339d85ec99e1fc.pdf
Resource
win10v2004-20231215-en
General
-
Target
233055d042fe4504e5339d85ec99e1fc.pdf
-
Size
88KB
-
MD5
233055d042fe4504e5339d85ec99e1fc
-
SHA1
e7568bf0fc450f4c83a8378aeca04570ded32bc7
-
SHA256
9f1c3f98e99fa944485c4559b6569062a0d1ac0267a71818082e2c115e58292a
-
SHA512
c82bc99ded755d860d4f6d047875ffebe6552247c73177ac8295dee98cf418376ef92b60c240d4c64cf08d9609574e77dc92c3c41484a6ca8724039961fc14c4
-
SSDEEP
1536:ioUTuWjC42/IXGvSmGfl3K9K2uTzbfsrWcNegTiQaEh6LkyogI+W0pOdWAb1PzzX:yrcPvmfla9aTzYyQaEh6LNogedWAZPz7
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1428 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe 1428 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 2428 1428 AcroRd32.exe 94 PID 1428 wrote to memory of 2428 1428 AcroRd32.exe 94 PID 1428 wrote to memory of 2428 1428 AcroRd32.exe 94 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 3272 2428 RdrCEF.exe 96 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95 PID 2428 wrote to memory of 4164 2428 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\233055d042fe4504e5339d85ec99e1fc.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5DF8E8A83B0D13534CC2D019C00947A5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5DF8E8A83B0D13534CC2D019C00947A5 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:13⤵PID:4164
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EEF09494F50F5BAEC87A933AF39363AF --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3272
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40E728D12D83F4D5E03DCCD3D1EBC505 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5076
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B7C101889914D3D7DAF703AC8A6B477A --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1064
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7FDC51642E703F41D1CC617DBA57DCE9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7FDC51642E703F41D1CC617DBA57DCE9 --renderer-client-id=6 --mojo-platform-channel-handle=2428 --allow-no-sandbox-job /prefetch:13⤵PID:5964
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFCB4F9856F5CDF86FADCCCC73F28879 --mojo-platform-channel-handle=2512 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5392
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d34c67060b32997062130d707e613e8e
SHA1223fa16625fe13806c0eb49a3974ae2757f4ab9e
SHA256acbe446ca04ec9ab6ad0b3f570a06216d7a1c1052305763baf7311e66427119a
SHA512bd668c776d0cb8287aa9dc97cc399be61f1535fa1fa165db34e18d3fddeaa0c31f18b6141aa32ec1074d8692fdc258a881b1f12041fd88bb259c22f648ec2d3d
-
Filesize
32KB
MD5eb2d67e01fb1ca34cfde38787e2a052e
SHA11f21d4553dce24983469463d26da9a5f76a9877d
SHA256cb3dfadbb4f69b8fc4e439797332624d1c72659536719262eb1e1f7922ef46b3
SHA512a5b2c1d688770b296ea23da294cf50d7c8628224906b29611122c932ce3a61fbbdffc682dbe1a645f6599ad6e4117f72c520022992251d4e095ea51887805de9