Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/07/2024, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
Controls Daily Report 06-28-2024 OT REQUEST.pdf
Resource
win11-20240611-en
5 signatures
150 seconds
General
-
Target
Controls Daily Report 06-28-2024 OT REQUEST.pdf
-
Size
41KB
-
MD5
8c031ce1aa9a626159e705d852c9ec52
-
SHA1
65c8041b9ccbeb72008984f7195a4a31399c011a
-
SHA256
ee24c7fb357144821a2f2372ed781dcb67550a0cb8b0697cf35916b960648dd1
-
SHA512
4942b0939233fef347e7ee5e30021b02dd547cf0d58c6fbf0288370a46fd1d678991219dccfe187531dbb87ca845d5f7dc17a3faa1f023b3aaf4f88271f07611
-
SSDEEP
768:yYIuWLQ91iCL7IxHabYjDXoSiW4anC1J3JkkBo33coHh/:HC2A4anCj3JkBBZ
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 332 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 332 AcroRd32.exe 332 AcroRd32.exe 332 AcroRd32.exe 332 AcroRd32.exe 332 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 332 wrote to memory of 4412 332 AcroRd32.exe 76 PID 332 wrote to memory of 4412 332 AcroRd32.exe 76 PID 332 wrote to memory of 4412 332 AcroRd32.exe 76 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 3248 4412 RdrCEF.exe 77 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78 PID 4412 wrote to memory of 4176 4412 RdrCEF.exe 78
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Controls Daily Report 06-28-2024 OT REQUEST.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2CA2442D8708FDC920982C585EF48656 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3248
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B091964C77ABBE1C44A2705F390D4499 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B091964C77ABBE1C44A2705F390D4499 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:13⤵PID:4176
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BDDAFC45B4F40098EEC935E9FE84416E --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5100
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7ED6D89DBD461803987A955413FDD5A1 --mojo-platform-channel-handle=1824 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CA1D580E673EA48442F2A0533C39166B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CA1D580E673EA48442F2A0533C39166B --renderer-client-id=6 --mojo-platform-channel-handle=2460 --allow-no-sandbox-job /prefetch:13⤵PID:2896
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EAA2420B7E9DC527B0A0B8BA6314E2D5 --mojo-platform-channel-handle=2808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4532
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4456