Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
Instrucciones español.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Instrucciones español.pdf
Resource
win10v2004-20240508-en
General
-
Target
Instrucciones español.pdf
-
Size
282KB
-
MD5
f28f9299a16556addaab436cfe444466
-
SHA1
f4249d38c3dcbefc8de53a04be893995433e5e5a
-
SHA256
11a003a272cad809f210df3b12f7072ec3c5d853207ed28a0a0b215bd8ad7fc8
-
SHA512
47b8ff84f5ec4591664ed4a02dc42f5859f443094a2b5ed0ec2d7a601aa2b28cea2cae54ac426372aa85492ff7457659f484ea35a504093ed52b1da86d581e45
-
SSDEEP
6144:DzZWzQ9jI3JBQNYTbBug+kMcKYakJNODuu7i0gCVE1+:5MQhCQNg+xPYhN8uK/gC61+
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4016 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4016 AcroRd32.exe 4016 AcroRd32.exe 4016 AcroRd32.exe 4016 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 2260 4016 AcroRd32.exe 85 PID 4016 wrote to memory of 2260 4016 AcroRd32.exe 85 PID 4016 wrote to memory of 2260 4016 AcroRd32.exe 85 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 1468 2260 RdrCEF.exe 86 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87 PID 2260 wrote to memory of 2868 2260 RdrCEF.exe 87
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Instrucciones español.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A4F3E82EE544F343EECC3699769B071 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1468
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=723589006308963D0A31E419C1225788 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=723589006308963D0A31E419C1225788 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:2868
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C9D0F94FD8FB24084D77E3AD5C7A4211 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1812
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A86B773E0AB8BB93A9F256AA387E603B --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4EBB0C346F7D385B1338ADD85FFDFF9B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4EBB0C346F7D385B1338ADD85FFDFF9B --renderer-client-id=6 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:1488
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EB989A4B16E0C0E8A42A0B04EE362078 --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3332
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52ceeb8800468ad0ab0771b0ff530db67
SHA16dd934431db535fe2c8a1bccb3159d0bb1eff384
SHA2565c34be2182cbc705151c4ea04eeee9d04cffc9727f5291a8c14e16d31cd655db
SHA51280d1d6e1eea4df82acdda62413e1259200b15f76f2cd36165e3e83a664b84334296faf009d37469fe065b24412b6ac240758ea923f77a1caffeb5c806c804142