Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
27s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/06/2024, 17:29
Static task
static1
Behavioral task
behavioral1
Sample
Panel_Fucker1_1.donotrun
Resource
win11-20240419-en
7 signatures
1200 seconds
General
-
Target
Panel_Fucker1_1.donotrun
-
Size
31KB
-
MD5
e014d7f0050c1c80143bd8a499656b7f
-
SHA1
68cd07e038f929941ffd3fc812bc2d3efa19ddf3
-
SHA256
32b0a8b1e230bb846a9519c4b14220286d07f05639645f95bfba2861f05c7c09
-
SHA512
8aa7b5502439394ddbfe2b567a46944eac100ab6f77fe3bfd4b467bec2fa1ebf437404b2c468280df6c77f6a26e789943a9dca66b847bed73671def9d33a19e9
-
SSDEEP
384:D4jmDysZcPulsZnYzKYm29vakAuz0FmziZMVzSgEPqJ+8uDa:ZDk2/zszuzemz/Vz08uDa
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3260 OpenWith.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 3260 OpenWith.exe 5112 AcroRd32.exe 5112 AcroRd32.exe 5112 AcroRd32.exe 5112 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 5112 3260 OpenWith.exe 79 PID 3260 wrote to memory of 5112 3260 OpenWith.exe 79 PID 3260 wrote to memory of 5112 3260 OpenWith.exe 79 PID 5112 wrote to memory of 3600 5112 AcroRd32.exe 82 PID 5112 wrote to memory of 3600 5112 AcroRd32.exe 82 PID 5112 wrote to memory of 3600 5112 AcroRd32.exe 82 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 4660 3600 RdrCEF.exe 83 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84 PID 3600 wrote to memory of 2724 3600 RdrCEF.exe 84
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Panel_Fucker1_1.donotrun1⤵
- Modifies registry class
PID:4224
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Panel_Fucker1_1.donotrun"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D21EEB3F5C5C759A5447F4AE776F5C78 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4660
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5995DC3FCEA6A9C8CADDCB47EB5DFC5F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5995DC3FCEA6A9C8CADDCB47EB5DFC5F --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:14⤵PID:2724
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F713AC65966E69CF371F6261B0D3CD05 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3540
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E589238004EAE9E71DE928205001D03 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3308
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BC3C87FC3309747F113C70E130DECA52 --mojo-platform-channel-handle=2396 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4648
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2528