Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 05:42
Behavioral task
behavioral1
Sample
cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf
-
Size
48KB
-
MD5
cc61c679173dd1d86424bafbf4c6a6e8
-
SHA1
9c3c27baaddca9e0e9ad5dea51b7c535ac41b494
-
SHA256
cef1009ed5c3807cf18d6f38afe6a0ad5041609f3b421803c8f7b02d22cbeec6
-
SHA512
fc369eeed5af129f2fb102b8b63a290dcd8ee80f05f7fd2975e4e3d0982949d0d231b9ba02ca5312f68269f65999ad817820f42df932a34b66987918efead33b
-
SSDEEP
768:+R0hIMsFKFuULw18uT3ZmA6ikhx0PK0PSTbltRvORiq2oNQGuH6BJ2rY:rhI/TFxTJzSSUTRvORi6aGYCsY
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 532 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 532 AcroRd32.exe 532 AcroRd32.exe 532 AcroRd32.exe 532 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 532 wrote to memory of 4804 532 AcroRd32.exe 92 PID 532 wrote to memory of 4804 532 AcroRd32.exe 92 PID 532 wrote to memory of 4804 532 AcroRd32.exe 92 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1580 4804 RdrCEF.exe 93 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94 PID 4804 wrote to memory of 1044 4804 RdrCEF.exe 94
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFCD9FDD07C06DA93E039C049B779F6E --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1580
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B2BD09FC1FD3A9673713C8167D716FB6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B2BD09FC1FD3A9673713C8167D716FB6 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:1044
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F71E307D8062AA888038BB472287FCDE --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:772
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B199FFC6A9C0DADA015FC531046E3843 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B199FFC6A9C0DADA015FC531046E3843 --renderer-client-id=5 --mojo-platform-channel-handle=1800 --allow-no-sandbox-job /prefetch:13⤵PID:852
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DCB9F9BD2A5CE5CCCFA1B1305B661152 --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1884
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4F55B8D23728589DEC4362F8FB539E9 --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:884
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD59e9961c8bfc7a363962b85209c67f98e
SHA12ad5df5ca01cc40c4d4edf1d876aa1479093d51d
SHA256529266bc900c4ca7a9704cb2f0e736443794b388a2cb894f8b717e1b21ae283f
SHA512a7f061f55bb17b6de21c372fff76b9e40fa168414910cab25839781ae4ed31da074fcb867722cdc3a7fd5021022925e8cb68e6d651e66ccc36c2b75abab612aa
-
Filesize
64KB
MD5083109033bdbe23033bd20dc59206132
SHA173073a66d2ac66949110af81438cc25d020e5cd1
SHA256d3d11ebc031bad07ed98db480156a21b0676b44e929f691d725cddbdd02cc237
SHA512931b02934624a7616c65fc7dc4a759011376192adcd9835fb6170cf9c960513d6149d36191066911d5e28b3049ad4283e21af100f08d6639c61b3b0222183b4f