Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 03:14
Behavioral task
behavioral1
Sample
c93e2de33e81abbef30dd69d8b157b78_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c93e2de33e81abbef30dd69d8b157b78_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
c93e2de33e81abbef30dd69d8b157b78_JaffaCakes118.pdf
-
Size
97KB
-
MD5
c93e2de33e81abbef30dd69d8b157b78
-
SHA1
2a2629e8be9e9f6fc3839e20628d1abb63225c76
-
SHA256
169e1e7b64c6cfbc763ca48d84ffde6afecfdc3a7c409b21053ac7fd8902f02f
-
SHA512
33e371f749664d8ef806a43e159dc67b7de4e0f69dad0776ee6c8a0c3ca452817b9d3435c69a7869746eefa35801189665b7aa34e6c559bf0e47466b0d91b756
-
SSDEEP
3072:TTxkUgjQZmxQlfErX1E/K4bD4i+WO75WF:fxOChErXu/dD4isq
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 560 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 560 AcroRd32.exe 560 AcroRd32.exe 560 AcroRd32.exe 560 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 560 wrote to memory of 2824 560 AcroRd32.exe 92 PID 560 wrote to memory of 2824 560 AcroRd32.exe 92 PID 560 wrote to memory of 2824 560 AcroRd32.exe 92 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 3020 2824 RdrCEF.exe 94 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95 PID 2824 wrote to memory of 4440 2824 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c93e2de33e81abbef30dd69d8b157b78_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A04B1E54A8F5B3A93EA93EE796CB5330 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A04B1E54A8F5B3A93EA93EE796CB5330 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:3020
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=25E93A9A256F1C9C82FA6D50529BCC4B --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4440
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E214795EA125B2748F5239544720999F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E214795EA125B2748F5239544720999F --renderer-client-id=4 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:13⤵PID:3992
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D68FA794D936DA34AB1D8D94C493259A --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:724
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BDA378E3F88EC989712334953B8DC592 --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:700
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3AA56B316E09746DDD4875CD983A26D1 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4884
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e09dee5cab1e668484b022b040430fd0
SHA1e2085c773fb31710e6826b897b7b5eab07acd8f6
SHA256498c66fbfcd9e01f39693d1cef2538506dd3b8cc92a2c7f3547bf6caadfc06b0
SHA51260c55a70b3d3ed3209d967cb6d52f89981802929c642986a31e90f4b41055812d6ccac843082ed6d2548cf57025440342748de8bd5ccaf8ebb82853d97d91b26
-
Filesize
64KB
MD570bec977847699af319d80c5394a0bdf
SHA1e0e13afec616f154dd6da15bbe7d884e6b4dc14f
SHA256625a1a280b4340c40ad838d2beb2711a81691e2971414e7dc087fbc67d2fedd5
SHA5129eccfc24bcf552955e2a6b6c396625231f69e0d287a53099dc2b45d45283ed3d283ea67335b21aa830bed34e7e67fc0ba65ca3dc941faca2844097c73aba9465