Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 23:59
Behavioral task
behavioral1
Sample
c549743b9b7d42bdb12b5ac9192eab2d_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c549743b9b7d42bdb12b5ac9192eab2d_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
c549743b9b7d42bdb12b5ac9192eab2d_JaffaCakes118.pdf
-
Size
95KB
-
MD5
c549743b9b7d42bdb12b5ac9192eab2d
-
SHA1
498745f19a317de6c272536f3c0b33725ec6f45a
-
SHA256
7251b911be65ede08c26c248053e268863887baf71415c48f3714cfe1fceea73
-
SHA512
9daab11feccd0e4f4954f2fcef2e2b6fda6b9d5edaaca9b81e0f49e1bad2740e85cf0ce7c21b535673690d0465261cf313979f55ddf46460408c7512b7a27f45
-
SSDEEP
1536:/xUwMrTo3RJphK3i/M5gEfnonSxP5aae+XF0AIjUlTitgiWa1OBfyFbWQpOCbtbA:uwMr0B0SdEfonSxx7D0gaFGCu
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3868 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3868 AcroRd32.exe 3868 AcroRd32.exe 3868 AcroRd32.exe 3868 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 1984 3868 AcroRd32.exe 91 PID 3868 wrote to memory of 1984 3868 AcroRd32.exe 91 PID 3868 wrote to memory of 1984 3868 AcroRd32.exe 91 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 1376 1984 RdrCEF.exe 92 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93 PID 1984 wrote to memory of 616 1984 RdrCEF.exe 93
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c549743b9b7d42bdb12b5ac9192eab2d_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=66C1EA75B1C84D4B4745B5C8F83E455A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=66C1EA75B1C84D4B4745B5C8F83E455A --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:1376
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=912996D0B06ED604C02FFD0899D304B7 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:616
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B7777458CCB9B321E6564224C3C70671 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2820
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3B2F50376E31F005293A55060A2DA454 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3B2F50376E31F005293A55060A2DA454 --renderer-client-id=5 --mojo-platform-channel-handle=2424 --allow-no-sandbox-job /prefetch:13⤵PID:780
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C86E2436CEEE3F329ADE8FB6F16ABAB8 --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4500
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E3E6DF8EA155377CCD4D5848D662722A --mojo-platform-channel-handle=2592 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3720
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD58ba673eeb5d86973b06f0ac139782cc7
SHA10108015286a66ccbb124c54187d5768a133b9692
SHA256103e7a0b71c1a0f2e33fdbd09e5d39c704a1e6f499e589eb2e947b2591a2d56f
SHA5129159edf1a009ce4ad7fd344246bf57738a6f5014546223ce5984ef122d1d9fb2fad003863abe8c8f31403803df9ff7aa140caa5503083ecd2d8a204ba6e66597