Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554.pdf
Resource
win10v2004-20240508-en
General
-
Target
2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554.pdf
-
Size
55KB
-
MD5
8b14ae7a7d7a596f7a3fa656c2c88c61
-
SHA1
b37c4122a482c4d36a25dfa6699a79ae6abbb80f
-
SHA256
2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554
-
SHA512
725f0a0afac86c5e8746a0d52922238fb218396002f98fe2564b24e1ab26f4867c8bbeb6add46ded19a5e38810642a57f58360f374d47ab79686763620d69d26
-
SSDEEP
768:D/s9uQVhN7lyl+CyTY2MZ4t6kOkNFtYN6KjEa05wLASVeyrYJ:D/+1VhN7lkVyTY2Mut6kL4zHIsC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2512 AcroRd32.exe 2512 AcroRd32.exe 2512 AcroRd32.exe 2512 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 4396 2512 AcroRd32.exe 90 PID 2512 wrote to memory of 4396 2512 AcroRd32.exe 90 PID 2512 wrote to memory of 4396 2512 AcroRd32.exe 90 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 2888 4396 RdrCEF.exe 91 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92 PID 4396 wrote to memory of 4948 4396 RdrCEF.exe 92
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2db9a04190193a10aad0e63a0a5384b4da212980d905e1fa722a5407fb689554.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BBC188DAB413F09C27753A69675E6973 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2888
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AA235276E3C4FE7AF92E82BEBEBA415B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AA235276E3C4FE7AF92E82BEBEBA415B --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:4948
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=430173043D1DBDBB269D5614C39D9E01 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1144
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=904B517A90153584A05DFF3F79F39BEB --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3296
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0669FAD12D78ACB3779F1BEC9E86E52B --mojo-platform-channel-handle=1848 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:960
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F53A64D13FE250FFBF02B868BF840C76 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F53A64D13FE250FFBF02B868BF840C76 --renderer-client-id=7 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job /prefetch:13⤵PID:2016
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD517b5b0582366b0eac79c721e667fc683
SHA1c14c43c194c711207fd1f6c25c1fff48e838e1ea
SHA25676a496eeb0db8caafd1fc48c58e6aede728153aa26889e749e3f9b696011f147
SHA51214b939ef1b8f96182cd72e3d2c59d68ac72d54cb4659b646dd5f3fa0631db87f2dd1b87a5019fbf427d6395634d0ad6dcd6f900cea267b2360ed23ad62e3900f
-
Filesize
64KB
MD5fc9a71a88908338a0d479e0375da6e33
SHA13998de70706e94a96b6f402358dc729a0a1d0082
SHA2563442ac791a4074e729e5a13c031a799cf4ea238f24a8a295474a14fca8e373df
SHA512ba500f605e0de87f6b084c8e93d85cf8d7836ab11c1cfd98a0beaddf8a8904a68b58bc4d4d8efdde2255cc9edf40ef51a2673e22553fa9467e593c3305436a9a