Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 22:52
Behavioral task
behavioral1
Sample
fb57353dab00d274d36e677a0c962bfe_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb57353dab00d274d36e677a0c962bfe_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fb57353dab00d274d36e677a0c962bfe_JaffaCakes118.pdf
-
Size
80KB
-
MD5
fb57353dab00d274d36e677a0c962bfe
-
SHA1
af41e04480361a2bf17c59a4f87aba150cff27db
-
SHA256
a3f397d44f5c4a1c56b37b709fd0088d53276dc89c6d59982a29b699b2c0bbff
-
SHA512
5bfb00c9741c7ebe1136ff43855e59fa7456a91f7f1b5277d916111d6913f4678e72dff431c5f70c449674833fe7913a355a6dd597221e07da42ce7db066479f
-
SSDEEP
1536:cjRqXVEI9xtwjknnE5e/PpEF1c1frr0/vqg0ggR9W5I1FlZWbpONFUp:wklv9hnCGp81wfU0nR86lbNw
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4996 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4996 AcroRd32.exe 4996 AcroRd32.exe 4996 AcroRd32.exe 4996 AcroRd32.exe 4996 AcroRd32.exe 4996 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 4032 4996 AcroRd32.exe 88 PID 4996 wrote to memory of 4032 4996 AcroRd32.exe 88 PID 4996 wrote to memory of 4032 4996 AcroRd32.exe 88 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 724 4032 RdrCEF.exe 89 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90 PID 4032 wrote to memory of 1956 4032 RdrCEF.exe 90
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fb57353dab00d274d36e677a0c962bfe_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A68F7F7C18EE0C425007861AC50FB35 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:724
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4A271199793F5E9E6532044F06058C53 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4A271199793F5E9E6532044F06058C53 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:1956
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B85864EBD94C0152DF48BC88D965D339 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B85864EBD94C0152DF48BC88D965D339 --renderer-client-id=4 --mojo-platform-channel-handle=2184 --allow-no-sandbox-job /prefetch:13⤵PID:4720
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D042904AA2C4262256BEC176EF64F506 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D042904AA2C4262256BEC176EF64F506 --renderer-client-id=5 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job /prefetch:13⤵PID:2916
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EF711EE673D26F19563B1D05BA9F057F --mojo-platform-channel-handle=2992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3336
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=08873BDB993A51AB7436D088A4F95796 --mojo-platform-channel-handle=1864 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4744
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A2F90554EBFD50E2C0C06452756F1531 --mojo-platform-channel-handle=2964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3348
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54085df90ec531357a596bd6d6d1a64c6
SHA1b02ff39ef293f53a0e5582866a2fa9a4e799cbc9
SHA25689144238a0d291c956f1583d99ad1d3c98242178a37c051228c5db4e4e5374d2
SHA5121c2412384417ac3dba4540c8172c2bdecafca8725c15ab83fefcbdde876c27f79b010475c8a7183ae902c5f1150ca9680eca34c9ff797a002117f0b71b8dec50
-
Filesize
64KB
MD56e5e02954a9159b56977e90b6bcc4079
SHA157d724ebb7e9783031a48a30902bfd9833b5330e
SHA256f1742a85e21b2127af372f8ffda8b648ec8fba925ece325716bfbd520bb55d38
SHA512d71130ee471240cbef602fb22377d299f819c7f859131d8609ccb133bf1c811e1fd99cad8ebd71e1a66f6beab70337750c1faf8339f27c14ce1c3e7033ffe8ec