Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 12:36
Behavioral task
behavioral1
Sample
fcc85ff274160f513886d843f3c113f3_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fcc85ff274160f513886d843f3c113f3_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fcc85ff274160f513886d843f3c113f3_JaffaCakes118.pdf
-
Size
72KB
-
MD5
fcc85ff274160f513886d843f3c113f3
-
SHA1
b417231d03bdbd4b98431507bed77cab5e7750df
-
SHA256
e851158cbfa69913e662eee574b5d40e212437e759ed6e22f9aed8adaeb4f620
-
SHA512
f04898200c3310204b1971ef027ac6deb2b989a224ce9e0baf23641495e3cc4c292c174e68c8257d500c8c7c4799c8905643b04503107e80edafbefb116c5a9b
-
SSDEEP
1536:qQ547ben7ziWlNWuK2Cj2KD3iYskW/8o2Ww1JWxApOGpSrdlme60:BL7vXWuK2S2y3K2T1O3G2PmC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4616 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4616 AcroRd32.exe 4616 AcroRd32.exe 4616 AcroRd32.exe 4616 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4664 4616 AcroRd32.exe 90 PID 4616 wrote to memory of 4664 4616 AcroRd32.exe 90 PID 4616 wrote to memory of 4664 4616 AcroRd32.exe 90 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 4412 4664 RdrCEF.exe 91 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92 PID 4664 wrote to memory of 2704 4664 RdrCEF.exe 92
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fcc85ff274160f513886d843f3c113f3_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F8C90BF5DBB173A0028C90A6405ACBBB --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4412
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0D6F391F64220FCA648881FACF5FBE51 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0D6F391F64220FCA648881FACF5FBE51 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:13⤵PID:2704
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B32A7238EDDE2A4CAD6454DD293E391B --mojo-platform-channel-handle=2184 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1496
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A9B2C70B61798065336B64B5C0911806 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4856
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2C3C4FCA809E7198ADC36C0E7FA47882 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2C3C4FCA809E7198ADC36C0E7FA47882 --renderer-client-id=6 --mojo-platform-channel-handle=2432 --allow-no-sandbox-job /prefetch:13⤵PID:4492
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=787763951B40511A9A9402EA3E6B15C2 --mojo-platform-channel-handle=2656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4696
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5dba4e8a6ea88579f4859a1edc26ae5b1
SHA1056f2925f92dfb8689eda547edf5b644c139c059
SHA2568f403b3d1a71fea79ebfa4cb4ceb0360aa78d15cc545533e3fd2fa3965d67344
SHA512947bd4323c714214f5066fd9bbe5fb4ae503789eb83e1526bc488e2542cf5b1ce1e33c7f1f9c21095ac1ad31517ccc552cbce48f7ae5bdd51beafcbe52eaa6bd
-
Filesize
64KB
MD5cf54256c0bf456dff032be50309d40b0
SHA1ff41a7abaa6d51dfc8d6cd48e8042bff36b962fb
SHA256fcb97b1ec904d6d10fb15602c44c8eb709a773c7672dfce59b42556b6ba0a036
SHA5121ce5fadbd02e540e5e006b4997d38c416b287cbfdd7791941120054618234bdb02547d9ecf5fb68b55f2942074c027441bd0e64eb2c7baea459ba80dd4305a6d