Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
Hil 2024 Financial Plans.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Hil 2024 Financial Plans.pdf
Resource
win10v2004-20240226-en
General
-
Target
Hil 2024 Financial Plans.pdf
-
Size
45KB
-
MD5
9af19598f0f20b0e807beb37d560bc28
-
SHA1
1be8e292735439fe67d622fd22bb9be8b6e6d422
-
SHA256
2fef0b3014e0e983fb461fcf56d3f7172e10a6170b65d7ed1cd1e3b51290d062
-
SHA512
d9cca9f7c8007183091efef1336f1c07504b8873553c183ead3244e66214b780a79a5ecccf6a94bf58b90feee31aa92eab6ab6fb91fcc0e36f1bbdc9c3a1e418
-
SSDEEP
768:TG/Ao2pRYMXb9+pU8Q/jco8Hfla52cp9mgLy8rCC+4X7QUecZ:TEAorR+b/jH8dyD7GC+4X7QGZ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 564 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 564 AcroRd32.exe 564 AcroRd32.exe 564 AcroRd32.exe 564 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 564 wrote to memory of 4900 564 AcroRd32.exe 92 PID 564 wrote to memory of 4900 564 AcroRd32.exe 92 PID 564 wrote to memory of 4900 564 AcroRd32.exe 92 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 2008 4900 RdrCEF.exe 93 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94 PID 4900 wrote to memory of 5004 4900 RdrCEF.exe 94
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hil 2024 Financial Plans.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=66A288E5E04D5EF828C99675491BC6A7 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2008
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1B242AEF4A7F909B911E77EF35F75F87 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1B242AEF4A7F909B911E77EF35F75F87 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:5004
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A1A560438A5FD7C816FCFCE6DF2014AC --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2788
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=413A632719FCAB98FC47F2E72E1FC8DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=413A632719FCAB98FC47F2E72E1FC8DD --renderer-client-id=5 --mojo-platform-channel-handle=1896 --allow-no-sandbox-job /prefetch:13⤵PID:4228
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16994A322C860299ED0DB863E933C31A --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:384
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BF2D8500239A409C76FCB321A3A8502F --mojo-platform-channel-handle=2768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:844
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD55f839f0015b33498b5a1b99676930c38
SHA1cc5c3b827fd94a84d3a1b15b52533f6a4cbc72cb
SHA2562a46d92c79eddc9e65177ba6e5b9e5ab5a81f2cb36e11cea64da420f13b26ac2
SHA512a1e8c37ea7c41cf68349646306c9b93e5f0f23164d616fe0476d9f2b4768bb9d597048377551f4fd8ff64d2989c50f1b0dc3ddcfb94683c631f6639c99b84d72
-
Filesize
64KB
MD57134d6a96320eaa1d8abf1772e22bd66
SHA1cefc8e6d2f94ccb1c5bb20ac09cc53f6251d86e4
SHA25655c426c50bc48ac94d3083e312fa2b02329b52206a6db0d2c2b6078484856298
SHA51234f40b2ba53a0d45341690dfd2a3d66a3c45804530df93ab772ce8e53ea87bf1504899156a7691ccd38e924c3ecb5d180ad4784ebf319cfe9416315a287e9564