Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 18:57
Behavioral task
behavioral1
Sample
72cb7539dacc1e2d2dc86a261f2a3e86.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72cb7539dacc1e2d2dc86a261f2a3e86.pdf
Resource
win10v2004-20231222-en
General
-
Target
72cb7539dacc1e2d2dc86a261f2a3e86.pdf
-
Size
79KB
-
MD5
72cb7539dacc1e2d2dc86a261f2a3e86
-
SHA1
4ac73f18b54878dbbf23e3117a3f93ff4b3ed5e1
-
SHA256
291dc0adccce2546f344148ac1522317cb00084a253fdefbe10a17b0de08138e
-
SHA512
14dd27451466173f5eb08f60a3459c5ea6ed3e200d145e4d75d9f99aeaee55b65f90234a2268912e1e772d413fd54a2d7320ba5bd9f9f9e2dde9c69bd5ebc212
-
SSDEEP
1536:l2ww5DapJOJxwHIr68vlDBvJDH5XpmGJesYOWBQXQuS5KB0j7EWQpOCcbo:Zs2JQCI2uvZH5XpmeepzVRKSj7DCT
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5040 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe 5040 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 1684 5040 AcroRd32.exe 92 PID 5040 wrote to memory of 1684 5040 AcroRd32.exe 92 PID 5040 wrote to memory of 1684 5040 AcroRd32.exe 92 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 1560 1684 RdrCEF.exe 96 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95 PID 1684 wrote to memory of 2256 1684 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\72cb7539dacc1e2d2dc86a261f2a3e86.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A6360D7F646A8F24714FE6C9625A1FA4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A6360D7F646A8F24714FE6C9625A1FA4 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:13⤵PID:2256
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=84D56C422180A5A5F463FD6C8C7ECBC3 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1560
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5E5EC67ADFA910821CFCF9E7FCF8ABE1 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1028
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9046678C5B21FB17D261E4788638B556 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3120
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7B3DA1F0E73570433A6DD527832A823D --mojo-platform-channel-handle=2456 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3032
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7261E6D03859DA54AC54DFDB3FAEC86B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7261E6D03859DA54AC54DFDB3FAEC86B --renderer-client-id=6 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job /prefetch:13⤵PID:3544
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD57bf6a8b6b0120b8602016db34813189d
SHA13f1c3ee11789a0d51f3ef0aa7138627f070c2496
SHA256335fad0a0f3a3ec3dd856f9a7d253497ba4af55aea6070cc08d25422ebcdcf37
SHA51291ebf2f7d5a2d01ac50f04a0a092f7b3486efee29f3ce1e47879191213612b51df5418c1b45623e58c5c9683f74655b16a9bc152360e9df40e28b4bcfea93425
-
Filesize
26KB
MD56fb407ebe205684ef234299ad40e9996
SHA1e1b70e731dbafd399d9f21a6f91ac2c968681229
SHA2562b131e3a0fd7d1d763f40b3a977326d8d7d9a1295d9a5f15522ed7193e19a54d
SHA512d4a2af55f273d398738efc017c4499a6f65d99b09c83332bf32ed2ab09b933a42f04ef2722be1f51e4286d635552b03a1b75337ac331a33e4a9ecb7e8f684622
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5