Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 21:38
Behavioral task
behavioral1
Sample
c6ec0146b8f42fa6c9d54fa334df68bd.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6ec0146b8f42fa6c9d54fa334df68bd.pdf
Resource
win10v2004-20240226-en
General
-
Target
c6ec0146b8f42fa6c9d54fa334df68bd.pdf
-
Size
92KB
-
MD5
c6ec0146b8f42fa6c9d54fa334df68bd
-
SHA1
2368399e32f8dd0cf26a183382795b42b76a2ca6
-
SHA256
03f645b2559f03be1519475b5d1cab8304860489cbee7a7214436bfd8e4c0bef
-
SHA512
63d20f481373adb27e4ef8fb15c184084927e18478a7027ff0afa57fc200c1bc3f07b82c00b11eb52dea48a06a6aa3262326e5461bdcffbd570cf116af2036aa
-
SSDEEP
1536:g15UuW0qVUxJUcYPXLRvx/o0oSpVjpSBECVhDlWkNpOPaWlVBu0A2ekLbn:wVW0q20dPXdvx/o8Vj01DuPdBusec
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5044 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5044 AcroRd32.exe 5044 AcroRd32.exe 5044 AcroRd32.exe 5044 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5044 wrote to memory of 436 5044 AcroRd32.exe 91 PID 5044 wrote to memory of 436 5044 AcroRd32.exe 91 PID 5044 wrote to memory of 436 5044 AcroRd32.exe 91 PID 5044 wrote to memory of 1744 5044 AcroRd32.exe 93 PID 5044 wrote to memory of 1744 5044 AcroRd32.exe 93 PID 5044 wrote to memory of 1744 5044 AcroRd32.exe 93 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2396 436 RdrCEF.exe 94 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95 PID 436 wrote to memory of 2284 436 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c6ec0146b8f42fa6c9d54fa334df68bd.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8F520DD94FDFD0A293FE38E787460CE7 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2396
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BB36B75F2E91528E605F7A0D503E85AF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BB36B75F2E91528E605F7A0D503E85AF --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:2284
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A0E8CD400DE0D5E45945EB210E9372C3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A0E8CD400DE0D5E45945EB210E9372C3 --renderer-client-id=4 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job /prefetch:13⤵PID:4548
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=514223E168B6BAFDCF6A33370CD3521C --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4888
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9C2EB39E1501DABA728A5AD1E2DBA1FB --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3988
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C4BC2FDFE4F60D0A84CBFD568C33D313 --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2628
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:1744
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5f7d3f16e4359392a93a41d7f046d637d
SHA1985b0686a2cc0c7174017e4f56dc172b441be119
SHA2564776d8c0a476e4ec3f989f301be120a4ea63172ca2a694677e92a016b073988c
SHA5129c4e690da4fd307697ec9d3c35cf35b23faf68f7087f7fa9303988fdb36f861499e121034022c466000568f17d31a639b26281bebde7e4dadca55350c8935f72
-
Filesize
64KB
MD5ea9e9780e76113d90a1fbe85c28be4e2
SHA15080ed426c6aef4e16ea766816706b923433f014
SHA25695c655d33234b11368059ffd617650978c20ccfeaeb682a68ec34a2b8f890183
SHA512090f68598c078e929fd29bd3a51cef8f2727142fab6171a4c9cdcc786f30bf6108cee71d82728066dd8df0fa61bdcd1fde04439df807cc12f42894072fb5fa92