Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 11:01
Behavioral task
behavioral1
Sample
fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf
-
Size
91KB
-
MD5
fc9c0ac706b56a8d7645e457d9eee0f9
-
SHA1
c27e1ba7e3997dcef97dc4a8d33bc609762713b6
-
SHA256
3ba5d83fbf2565248980bd8ba66bd001b91fdcf0c49df97251b8eb679160b53e
-
SHA512
b6a0761a9515a0e962b87355bddfa175985d13aa82f219d264a36b54bed550fc9160bbe537f1c2a141d39d1c380ae4d5d054441427fa49894e2de612174f134e
-
SSDEEP
1536:1R9XVaSZ2QDPP16AkDUZWgpj/bW/vg/kVVJjdNXWd/8GTzBtyojKlT7U2wyHhTEU:X9XHUQTkDU79bI4/8RNA8GTzDyn42wy/
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1800 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1800 AcroRd32.exe 1800 AcroRd32.exe 1800 AcroRd32.exe 1800 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2632 1800 AcroRd32.exe 84 PID 1800 wrote to memory of 2632 1800 AcroRd32.exe 84 PID 1800 wrote to memory of 2632 1800 AcroRd32.exe 84 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 3496 2632 RdrCEF.exe 87 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88 PID 2632 wrote to memory of 4936 2632 RdrCEF.exe 88
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1761EBC023AF82582944D6497B65333A --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3496
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D5D263D562D430655702EE795B3DD631 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D5D263D562D430655702EE795B3DD631 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:4936
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4AB0516EF2630E989F48A7CF39BEBC95 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2524
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=90ACA1D45FEAE3EE918B0B8A39633B2C --mojo-platform-channel-handle=2436 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2716
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9BDB930E7265BC4B5869687D72DCB9A9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9BDB930E7265BC4B5869687D72DCB9A9 --renderer-client-id=6 --mojo-platform-channel-handle=2480 --allow-no-sandbox-job /prefetch:13⤵PID:4184
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5E34507A0BFD8406983ACDE37B6310E1 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4812
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD50c272d05751906c315d6d7a2c25a6d24
SHA11d7afe4e89b4a74210c093bcea1f9027d50c8cf0
SHA2561c595862c7af7ec5aa944966eb8863e3a7da4bf57c8e80556fe5bdb62fbb3b44
SHA512e90cffe2d9a60ef80e60b8fddde7cc23e72f80d62e2217f45956b339f1b36279b7d0f44373bf576a38169cd5c93c10e0c26abef744d17371a9ec41312f7071f0
-
Filesize
64KB
MD50bdcda1a8fa4b022a4e581568741bd67
SHA15e610d226bf2f48668bcd6cd90abe7f90a55f70d
SHA256c951123bd51cf23acadf0690aa20e9ae6c9cf1554b17362857ec85c70b9ab30b
SHA51209dd9fdac1f2e2556f684e2d29d403a81dbfe29a1aa198b1088abac1e870b441939f898ffdf626fb86759e4bcf6b2eed507467489af089ded7a6db8abc57a4bb