Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 19:38
Behavioral task
behavioral1
Sample
a9fe1d969b090e54dd330c7d1e1b434c.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a9fe1d969b090e54dd330c7d1e1b434c.pdf
Resource
win10v2004-20240226-en
General
-
Target
a9fe1d969b090e54dd330c7d1e1b434c.pdf
-
Size
44KB
-
MD5
a9fe1d969b090e54dd330c7d1e1b434c
-
SHA1
a98f329013090a2ba58d4aad37de22077e6b88fb
-
SHA256
7ef3a196263fd10f359db7b014e8e07527fbe1031bcd1bd3bea9c6f6086945b7
-
SHA512
b416c86fcb87dc2b433437ad7d2c5c9b2eac0f8a20f824e2aeea4d3523fec0a113e5224e7261d605692276ce5cf5d7170eb5e81a2d27d06ebba49be5f4c75cde
-
SSDEEP
768:szU3jMP6Bhm1ye8bB9Rgl6BY96COYCKSNu5vd0zyowfsXnwbKT:kHahm1uBIuFC/dSIxuzyowfiT
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1280 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1280 AcroRd32.exe 1280 AcroRd32.exe 1280 AcroRd32.exe 1280 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 824 1280 AcroRd32.exe 90 PID 1280 wrote to memory of 824 1280 AcroRd32.exe 90 PID 1280 wrote to memory of 824 1280 AcroRd32.exe 90 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 1368 824 RdrCEF.exe 91 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92 PID 824 wrote to memory of 212 824 RdrCEF.exe 92
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a9fe1d969b090e54dd330c7d1e1b434c.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8D34B52EE3676938F6412CB9F623D8A6 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1368
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=616E72EECB9C571D2B2997F4B08EAFD8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=616E72EECB9C571D2B2997F4B08EAFD8 --renderer-client-id=2 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job /prefetch:13⤵PID:212
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=693E5D9A54A9133FF8C69D9BE2D204C2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=693E5D9A54A9133FF8C69D9BE2D204C2 --renderer-client-id=4 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:13⤵PID:1892
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=340374560F85F2447DAA0A5B27968C5E --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1660
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=17103607257D47A6FB75909527919AF7 --mojo-platform-channel-handle=1936 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3060
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A5260A9FE7B16BE765A42D247A01B0CF --mojo-platform-channel-handle=1892 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1820
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ad0e8ca2aa4555b29862e0a7a6f83e15
SHA1b45c8b7a42de5159ee1544a8a54043ffed3ad556
SHA2561ab72c519b1c025858515a8066e700a951f166024714377279ef63a552327561
SHA5125b40c30a5bfdd8355bbdda6241854a6c72ba10e2b40fb36793d3ee18137f3dcd9898729fbabe4b5a6cde11250c7490a641338078cae048d226a276a8c07829a0
-
Filesize
64KB
MD52b81e6c12b204635a6e61ed96ec653da
SHA1ede3b3bb547256c88902001658111dca7afedf4b
SHA256aef054c6368f071fc3ff92c5506902911bab577f41a352a15a0b75dab0565327
SHA512f7ebc1ec02b75a3e9890803623781f3f25010a732213fae79de80fa65dedf77321f2e702a55a4a6779fe73fdadb269a591d83010ebb638028f273a02db9d1c62