Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 22:49
Behavioral task
behavioral1
Sample
51d5228e5d431aed857666697da73275.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
51d5228e5d431aed857666697da73275.pdf
Resource
win10v2004-20231215-en
General
-
Target
51d5228e5d431aed857666697da73275.pdf
-
Size
87KB
-
MD5
51d5228e5d431aed857666697da73275
-
SHA1
4c64a294eb8e818e3252bb360f378cde06e4e2c7
-
SHA256
189fa0ab75aaff1ac015bd90c9667c248818d30f622ea53c147cd5d608ebe222
-
SHA512
663b00c3be913686a0c0671d0a38fdad48bdfb030433d49cb1ae3006e5bfa49975f5a298cbad2f38a26b219ce6b3ab56f49ca3d14a58e6280d6856f19ffb4596
-
SSDEEP
1536:/FZUhBa8/XtHruaUQ0BUBIaXuxPAhUcUG/nzZgZ+uWEU/nNwWQpOCNBt:yJtHrRqBZaXuxPAhL7RKunNfCp
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe 2924 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2352 2924 AcroRd32.exe 92 PID 2924 wrote to memory of 2352 2924 AcroRd32.exe 92 PID 2924 wrote to memory of 2352 2924 AcroRd32.exe 92 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 2636 2352 RdrCEF.exe 94 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93 PID 2352 wrote to memory of 864 2352 RdrCEF.exe 93
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\51d5228e5d431aed857666697da73275.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=79D5AA64E39B75DCF6E831D574966C96 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=79D5AA64E39B75DCF6E831D574966C96 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:864
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7AFE458400B84771237A459232B37829 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2636
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=07C43D75231C0B166CF67043818BB1F8 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4936
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=62BA1B9BDB3C292FAE9FE3BFC7245F0C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=62BA1B9BDB3C292FAE9FE3BFC7245F0C --renderer-client-id=5 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job /prefetch:13⤵PID:4800
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=084E7D9467F5A94F4E07C073FB54DAB3 --mojo-platform-channel-handle=2468 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4736
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=71530DA1FE1DA28A76DC64E10809F2E5 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4684
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1432