Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2025, 03:51
Behavioral task
behavioral1
Sample
sara.apk
Resource
win10v2004-20250129-en
General
-
Target
sara.apk
-
Size
2.5MB
-
MD5
358acf61b0e964e69f5d7cf1d72c30f9
-
SHA1
a3973c80b2a69a3fb37f828ea1ba1788544cfb1c
-
SHA256
b82143e05acc3b55eb1e950883fb5f5476a8aeeca36578ac9c16a9a054189b05
-
SHA512
6e5d9cb3865697c4434990499c02166910aecb2c082732dc43ef6c054fa1ec10a632806e0a6a7533dc9e2de352077b7be6ec57104ba012125cb5762255dc4d5c
-
SSDEEP
49152:J9mRYlXpw0vrWLWmRYlXpw0vUWLamRYlXpw0vkWLHmRYlXpw0vNWLc:JSYlXp/vqLDYlXp/vjLvYlXp/vzLIYlf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\apk_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\.apk\ = "apk_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\apk_auto_file\shell\Read OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\apk_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\apk_auto_file\shell\Read\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\.apk OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2164 OpenWith.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 2164 OpenWith.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe 3748 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 3748 2164 OpenWith.exe 89 PID 2164 wrote to memory of 3748 2164 OpenWith.exe 89 PID 2164 wrote to memory of 3748 2164 OpenWith.exe 89 PID 3748 wrote to memory of 4632 3748 AcroRd32.exe 92 PID 3748 wrote to memory of 4632 3748 AcroRd32.exe 92 PID 3748 wrote to memory of 4632 3748 AcroRd32.exe 92 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 2416 4632 RdrCEF.exe 93 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94 PID 4632 wrote to memory of 3152 4632 RdrCEF.exe 94
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\sara.apk1⤵
- Modifies registry class
PID:2424
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sara.apk"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CAF44E1E948CA6481B7D27052D585656 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2416
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=049560E29ADFED19A197DE00AD1DDBEA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=049560E29ADFED19A197DE00AD1DDBEA --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:3152
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4682D1E036090165CCF0FCEC5059229 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1724
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DE4E745CD093CB447C79CA72DFD989AC --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=588ABD59D824F688DC3C66933622E579 --mojo-platform-channel-handle=2400 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4440