Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 22:28
Behavioral task
behavioral1
Sample
4d52a68027bfbbee846330747bf3a2c5_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4d52a68027bfbbee846330747bf3a2c5_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
4d52a68027bfbbee846330747bf3a2c5_JaffaCakes118.pdf
-
Size
39KB
-
MD5
4d52a68027bfbbee846330747bf3a2c5
-
SHA1
3176c922467bd31dfb0888af1e1ae484ae463371
-
SHA256
87d3e5bb36976f20b7bb52c3e6ec63c1252336aa02a1978e46aa29add3bc5290
-
SHA512
42db2e9f3bfc2b80eab59c255cd5f89333670af054554f18621d99807dbd39a31c49b5f1a9c2b4014cf72592c98e3c2d8dab1a6544c99d086c39a1e18e8a3a02
-
SSDEEP
768:KgGzpD4pbBmlYi7s+hC/zTJsdwlkiwK/5XR9OY0+RZPxfPsc+jahTvtul:XGFspbl+MXBh+KfnWahTvtul
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2592 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2592 AcroRd32.exe 2592 AcroRd32.exe 2592 AcroRd32.exe 2592 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2688 2592 AcroRd32.exe 91 PID 2592 wrote to memory of 2688 2592 AcroRd32.exe 91 PID 2592 wrote to memory of 2688 2592 AcroRd32.exe 91 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 5016 2688 RdrCEF.exe 94 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95 PID 2688 wrote to memory of 3892 2688 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4d52a68027bfbbee846330747bf3a2c5_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0CD8CB19DE6FECCACBBA6F6D407B59E6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0CD8CB19DE6FECCACBBA6F6D407B59E6 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:5016
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A8FE785E5B085011E534B27D8FC0BB9 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3892
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D3C342CD9D355E087F6B68B9FAAE042B --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2208
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AAB16ABC5BF819D8D6A5DA6DD776B3B3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AAB16ABC5BF819D8D6A5DA6DD776B3B3 --renderer-client-id=5 --mojo-platform-channel-handle=1984 --allow-no-sandbox-job /prefetch:13⤵PID:1368
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=389F35201732F0E82624EE9CFAAD07C4 --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1720
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AB2A6D16166834F41BE5DE5C2B4876E --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3580
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52c6569eca7a479b6d3c94e24b9c0d970
SHA1e8414da11f5c1673588808294530864f5f8127f6
SHA256da1e992de2348e276b69bc8ade0566e034c92d575ade8b0d62de696cde1703f1
SHA512ed29a1b9894dbd65a1954972d973ed7d4f8a1f6dbf2ea17dfa5a20114ac8aee745e2d8aa719b87003566cee0a14be1188daaed625d48bf68de4ee5d249f6ebce
-
Filesize
64KB
MD5e7bb2afc667d9358f111ea4433696744
SHA19257bd77fb20f8e5d05516974a4ca4f85e8a85d6
SHA25651e5b89e453ff9e8da9b3d3c7308ddde8acb4f995fe16bb6b9b153ddfee7305a
SHA5120f8036fc9c3728653ac71d5f93ade0dab32bbdec2a8c24277845c23c049dcd2d605944b5ef7c440f715bd4f93fe13fdfe64b1e3aa4fc0c8a18dfb6fb56678610