Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
57s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
12/01/2023, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
Bobs_Refunding_eBook_V7_0.sh.pdf
Resource
win10-20220812-en
6 signatures
150 seconds
General
-
Target
Bobs_Refunding_eBook_V7_0.sh.pdf
-
Size
12.5MB
-
MD5
beb4a49462bc25dbfca6296eb07470bd
-
SHA1
d9c0fc7413f811a3f0219db2bd34bf7f50fe8de6
-
SHA256
be2c386a0e82d655569f73940e2857e327b787cf069a2f489204311fdbe8e65c
-
SHA512
5a1e9781899b7d7569fddc87d6825c69fd23bd72d9416b49c095c59b17653dcb685d0678d36010fbd9c4998b1b5f446a26c8cd3ce12e61b1be71514a6f65d28a
-
SSDEEP
393216:rFizwUKHBNePf6iDFSyvggYYniM0pWuiDpAIEXLC2:iQBcqiDraYniMeliDlEX22
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4788 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 3484 4788 AcroRd32.exe 66 PID 4788 wrote to memory of 3484 4788 AcroRd32.exe 66 PID 4788 wrote to memory of 3484 4788 AcroRd32.exe 66 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 4584 3484 RdrCEF.exe 68 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69 PID 3484 wrote to memory of 900 3484 RdrCEF.exe 69
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bobs_Refunding_eBook_V7_0.sh.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=54C4A49FEE89C1158C1AFC957EF6189F --mojo-platform-channel-handle=1644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4584
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=71A228F4FF8405C1BCC50C7930EE8F1E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=71A228F4FF8405C1BCC50C7930EE8F1E --renderer-client-id=2 --mojo-platform-channel-handle=1512 --allow-no-sandbox-job /prefetch:13⤵PID:900
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=001F7B1451E8B7EA7BD3A10897EF0836 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=001F7B1451E8B7EA7BD3A10897EF0836 --renderer-client-id=4 --mojo-platform-channel-handle=1988 --allow-no-sandbox-job /prefetch:13⤵PID:2136
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=571FCDF957644A68D0D155348B7E13FE --mojo-platform-channel-handle=2608 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3316
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6733BCD1CFB2693A73CE56238487A96A --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:336
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=05D8F967C8504058188344FA5D45471F --mojo-platform-channel-handle=2736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:584
-
-