Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 15:00
Behavioral task
behavioral1
Sample
56c6a2f814439098678f347f3b4222ca.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
56c6a2f814439098678f347f3b4222ca.pdf
Resource
win10v2004-20231215-en
General
-
Target
56c6a2f814439098678f347f3b4222ca.pdf
-
Size
88KB
-
MD5
56c6a2f814439098678f347f3b4222ca
-
SHA1
dd970dae5b208c179f368dff57d96055e1bd63b8
-
SHA256
b66dc5ade2b9ed254cef55d7eed0778c671d8ca3ace9f2611d87d280da709ff5
-
SHA512
0d1f7cb05f2740f928d0434e8defaa54e7579e3e15693c094f31255a0968d4fb1f317130068786fad7cc30750d780df3b107dcc011e94b2065a680b68ba8603c
-
SSDEEP
1536:RUekEciD7vFmdDiVFllsPw4deqAELKnwF3TfwrqLRfVHkN/C3SjSafeMQegm0wp+:OekyD7HFllF4dBe+fwEe0aQfm0a+
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4784 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe 4784 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 612 4784 AcroRd32.exe 94 PID 4784 wrote to memory of 612 4784 AcroRd32.exe 94 PID 4784 wrote to memory of 612 4784 AcroRd32.exe 94 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 2152 612 RdrCEF.exe 95 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96 PID 612 wrote to memory of 3000 612 RdrCEF.exe 96
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\56c6a2f814439098678f347f3b4222ca.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E2BDBD90FA5089E05B52221750F9DC50 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2152
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=572AA9036EAFC11F76678C517451E7F9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=572AA9036EAFC11F76678C517451E7F9 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:3000
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=772A639D23DE913722C42EA89C51E512 --mojo-platform-channel-handle=2260 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:912
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C27884878D9750160F3FE37E072C194 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2540
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=282FD84B97C78FDF763CB0A1258B2CBB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=282FD84B97C78FDF763CB0A1258B2CBB --renderer-client-id=6 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:13⤵PID:1884
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41122A11D7CA6C1B061881B437193AEB --mojo-platform-channel-handle=2020 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2196
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5b64266a08ec0cdfd6c315657817f5d6b
SHA1cecf035766d99754cd0c7f866d8e72b6728f7cfb
SHA2564eebcd30239d6edea3418d7d9c146e72ac7dda7bd0c4ce19de38b91df90fe8d6
SHA512e6e03e689ffa8a58d8df5084621c6f687408aeba85a36122a2af750e0e11bcea7a2917a20dfc5e09afb35cd9de04f7e6a1dd38f654b65c950eb60841facce6a0
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
2KB
MD524c372cdbf309a981626ab7ca62582f1
SHA1a0ee214c92ece39e74b28e4023f95b348d44a4c9
SHA256caf3f040692427b2722821b099158b094658b014e93ec0c248aec7873434065f
SHA512b3b7c45020bf0204d5f71258008a1efe5844166a6d4388ab33315093fa9eca5833bd1f8968a4821f6c774725d644c6e0ae99518c6490375647abadfc60d46e8a