Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 17:02
Behavioral task
behavioral1
Sample
27a6a1e007c17ea7ca34ccd72c6dfe7d_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
27a6a1e007c17ea7ca34ccd72c6dfe7d_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
27a6a1e007c17ea7ca34ccd72c6dfe7d_JaffaCakes118.pdf
-
Size
74KB
-
MD5
27a6a1e007c17ea7ca34ccd72c6dfe7d
-
SHA1
91b993952bd2b5fb4fb485cf93d7af2603e93738
-
SHA256
4ab738d4346220589b2549d9092cc8146d958515d6d320cb3055ce27803e91f8
-
SHA512
dad693bb62c5915761e086f195ebdd228ad3bbc8611649f02d72bb4fcda9cee4b43e2952817eb726e82db0b6d67563b4a0e83e9031b488e9f0352a2f0974f1e8
-
SSDEEP
1536:CXECBIcVxP0gxOAQhUhKJIRZHWMj33WkNpOPaW+V5D/RcJ81Y:lOJ0gxwjJoWMjIPI3Ruf
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 876 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 876 AcroRd32.exe 876 AcroRd32.exe 876 AcroRd32.exe 876 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 1576 876 AcroRd32.exe 88 PID 876 wrote to memory of 1576 876 AcroRd32.exe 88 PID 876 wrote to memory of 1576 876 AcroRd32.exe 88 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2032 1576 RdrCEF.exe 89 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90 PID 1576 wrote to memory of 2000 1576 RdrCEF.exe 90
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\27a6a1e007c17ea7ca34ccd72c6dfe7d_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F01C1DC4151A4692BEBEC2B35E374172 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2032
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1F80C98147491CBAC840CC7A76E69F06 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1F80C98147491CBAC840CC7A76E69F06 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:2000
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=53D04E246F5CB099BEDD6FD3BE03401F --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4120
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D0ECB41004F7912E32D47EE636FE0E82 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D0ECB41004F7912E32D47EE636FE0E82 --renderer-client-id=5 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job /prefetch:13⤵PID:4092
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5154B10CBC18DD23E9C34AD68E126BC5 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:392
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C2801FBCA5C14C78B1A6FD4EE92E923E --mojo-platform-channel-handle=2376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3396
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5a14809821e3569378edeffad232cb29b
SHA146d74a84e7c52f8305117a807e74dd7e91e787b8
SHA2561dae67f18859353bc97dbff829361799fba4f4b758fb0a9c288a141be2f8f3c1
SHA512be458953f6d19d6c0b7ae88bab0960385c21c011094266c91689684404313c83b39eecbe0dbd4dd91387d0942a4bb24bcb8127d9ef2282a21dc1049954e76f9d
-
Filesize
64KB
MD57c27e5a0134dff62ba5883bf04c10db8
SHA15e385270dfe19156fb2045e82618ea2371961b50
SHA256314a2b552ee6b6e094735b77b438688bf606291e72334b3156c3d5940350e674
SHA51260ccd6e9c03f5f1a29e990ab1b3a3eb2caf7aa4900e1c3f64e5d5954c51fc465f8c024926670dd793bd48d3dba0d100b6f72799f484a1307d7daa2f22951bf9f