Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 20:39
Behavioral task
behavioral1
Sample
3674a6c8e97054c39e1b60b993a73f9e_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3674a6c8e97054c39e1b60b993a73f9e_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
3674a6c8e97054c39e1b60b993a73f9e_JaffaCakes118.pdf
-
Size
35KB
-
MD5
3674a6c8e97054c39e1b60b993a73f9e
-
SHA1
f3db13698a32535fdc6c59379476c51b110d046a
-
SHA256
0d2eba655ac9dc42831d8959b4383fbe7139aa1c20b58109c6baf146317c9f60
-
SHA512
35e9dd33648d5ed681d164be8290f22d48c714abda953c85af292991dc04c46c4aab067218dbd4c76778781e0f4cd389bb185e9f435d2d88b7951378933a2c22
-
SSDEEP
768:i/XuMZmwgCLWarM+Sl3EB6tJNMW04hf3rA1:i/XFZmGWSKcWNBx93rA1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2312 AcroRd32.exe 2312 AcroRd32.exe 2312 AcroRd32.exe 2312 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 3148 2312 AcroRd32.exe 88 PID 2312 wrote to memory of 3148 2312 AcroRd32.exe 88 PID 2312 wrote to memory of 3148 2312 AcroRd32.exe 88 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 2456 3148 RdrCEF.exe 89 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90 PID 3148 wrote to memory of 3184 3148 RdrCEF.exe 90
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3674a6c8e97054c39e1b60b993a73f9e_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD4CC60321766DBAF6CDE53D212B861B --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2456
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BFD79E50921BE1CA01971AF84277A925 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BFD79E50921BE1CA01971AF84277A925 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:3184
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4EE015AB4B4DF7BCA0A0D7B67984FFA --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1640
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1106F668A18539B5C3BB8FABC16C100E --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5056
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6FCD158480BC6C25421C7426EC991299 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6FCD158480BC6C25421C7426EC991299 --renderer-client-id=6 --mojo-platform-channel-handle=2368 --allow-no-sandbox-job /prefetch:13⤵PID:2656
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C0FCEF1EF972E9290F51F851C641B168 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3660
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5136372333ec7dd573dda41c575d64f3a
SHA12f4e82225a24368351775e6e9158391e0419b04d
SHA25625c499b8bb8c5747371fd5e7f73a2124e1c6f3b50c7cda468242d193b3329291
SHA512aa48c9e930a1c3cb055654e58a766878fc6a76a175461b5d3fc9d9b0d54818b3b1c77fbd99e01e503f10d864c48c845178ac8d2a9ee86403f4bc22e20c7f18fd
-
Filesize
64KB
MD5387d479e3da189a75b4c4f4893c6e5cb
SHA14a0a4109d99c85a272171b093da5db71d42d00e7
SHA25659bf7c58470d26a37a34602178461d85c11d4929c2c59186da2ac441e82ce243
SHA5123cfd8888aff860dbfb78bae627168af1a9793c64f0aa4379b556b99d182a3c20d97ef843b61fe7132107774a8ac39a230b8fe8bfd3fa2281d564096e7ad861db