Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/03/2024, 11:00
240312-m4d7jshb86 712/03/2024, 10:59
240312-m3g7tahb69 412/03/2024, 10:53
240312-my2ewsfb61 112/03/2024, 10:46
240312-mt968sha44 712/03/2024, 10:45
240312-mth3raha27 112/03/2024, 10:42
240312-mrtrgagh67 712/03/2024, 10:40
240312-mqwvfagh48 712/03/2024, 10:38
240312-mpq8kagg96 712/03/2024, 10:34
240312-mmbp4aeg7z 1Analysis
-
max time kernel
10s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
w3.org dummy.pdf
Resource
win10v2004-20240226-en
General
-
Target
w3.org dummy.pdf
-
Size
12KB
-
MD5
2942bfabb3d05332b66eb128e0842cff
-
SHA1
90ffd2359008d82298821d16b21778c5c39aec36
-
SHA256
3df79d34abbca99308e79cb94461c1893582604d68329a41fd4bec1885e6adb4
-
SHA512
f3b3ab3e6351e25b5c1882bea8d37efaddc0ea72bf153bb067688f775a26810d32b54f014bf1cebc7fe93042d85b18b5b453e322d154bc55d5cc2754b0dfb4b2
-
SSDEEP
384:8Xdp2nmyTBbQDcv6ZxmiiYcIWyGqBRnfU/LaLvWB27:G8mibQDcvSxm14Wy95fU/2TWk
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5084 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5084 AcroRd32.exe 5084 AcroRd32.exe 5084 AcroRd32.exe 5084 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 2044 5084 AcroRd32.exe 92 PID 5084 wrote to memory of 2044 5084 AcroRd32.exe 92 PID 5084 wrote to memory of 2044 5084 AcroRd32.exe 92 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4484 2044 RdrCEF.exe 93 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94 PID 2044 wrote to memory of 4080 2044 RdrCEF.exe 94
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\w3.org dummy.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4D184CF42A0ED02A33924F22E50CC76 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4484
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E544AFAADDF7F43192B060C34AD8830B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E544AFAADDF7F43192B060C34AD8830B --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:4080
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=99DF52A308E69FA402156664093DB95F --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4764
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3CB2B7A79EDF465D33E28FA585FD6907 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3CB2B7A79EDF465D33E28FA585FD6907 --renderer-client-id=5 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:13⤵PID:1020
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1C960D11D81D945026A442E1BC8C5C2 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4392
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3B588CAEA434539331F7A3B76DF96FE1 --mojo-platform-channel-handle=2004 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2364
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2720