Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 16:01
Behavioral task
behavioral1
Sample
51003931ff0211cbc98ed50210d92894.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
51003931ff0211cbc98ed50210d92894.pdf
Resource
win10v2004-20231215-en
General
-
Target
51003931ff0211cbc98ed50210d92894.pdf
-
Size
84KB
-
MD5
51003931ff0211cbc98ed50210d92894
-
SHA1
7a43ff27ad66420eaae4b7ce78fd7c0aacc4ee2e
-
SHA256
449393b9d583299d26b27befa939901a3538e29e1a7a848a4a841a7f7bd0ef28
-
SHA512
368d30ea16d04ba40a7b6dde02b269ec82334418ea1911fbb8ad8a419cf62678ea09739833bc49b54935e5c83a02408d3444b4631503c2799db1f8d22ce59aa9
-
SSDEEP
1536:NCwChE/HxyAgODdO87r8p2QXNpZx31JjwMrhWHpOvTWdwzc4BKisnJI:YfWHxyA9dO92wR1twgvx9Kisu
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4432 AcroRd32.exe 4432 AcroRd32.exe 4432 AcroRd32.exe 4432 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\51003931ff0211cbc98ed50210d92894.pdf"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4432