Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 08:05
Behavioral task
behavioral1
Sample
715721dfb784fe35901a5c9178ab3a25_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
715721dfb784fe35901a5c9178ab3a25_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
715721dfb784fe35901a5c9178ab3a25_JaffaCakes118.pdf
-
Size
39KB
-
MD5
715721dfb784fe35901a5c9178ab3a25
-
SHA1
3b9399b9d6e63ff14a4bebfa9bca9d96fdec2ce2
-
SHA256
d6d03b93247ab686778043165c70458e4c92bf2a2cb4e4d1d2e8370e190c9b78
-
SHA512
28ef59f50fea3e688600dba5fa07e3f405fda7eb3fa771f6e3bf0c2d146ee9611c8ef75e22ecbfeca7dea95a02cb33ba3807107ff5f63a101601c1a3a2b90012
-
SSDEEP
768:3bgGzpDX+f5Mb2rJoZPe14gh0D9W5uQhJyLtku1VOGj/iu4j0jqWuL:0GFbwrhwCu+JLWVOGjaZj0jqWuL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2432 AcroRd32.exe 2432 AcroRd32.exe 2432 AcroRd32.exe 2432 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 3536 2432 AcroRd32.exe 92 PID 2432 wrote to memory of 3536 2432 AcroRd32.exe 92 PID 2432 wrote to memory of 3536 2432 AcroRd32.exe 92 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 1052 3536 RdrCEF.exe 94 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95 PID 3536 wrote to memory of 924 3536 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\715721dfb784fe35901a5c9178ab3a25_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4CB708AC314FC36C8A46127A611152E --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1052
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2436D360D3DE9A4B6D30BE37FEB8C14F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2436D360D3DE9A4B6D30BE37FEB8C14F --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:13⤵PID:924
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0CCD03D6D8BB3152A04EB9AE1255DCB9 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4576
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=291DC8BACF48830AE6F6CCECD20D6299 --mojo-platform-channel-handle=2436 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2888
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=799776AE0015AA07D15DC0B8D305765D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=799776AE0015AA07D15DC0B8D305765D --renderer-client-id=6 --mojo-platform-channel-handle=1896 --allow-no-sandbox-job /prefetch:13⤵PID:3492
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0C31D6E139FB7743B6EF7D25605407D3 --mojo-platform-channel-handle=1884 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2228
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52d756062ece9f5594d9a05e8763f5ed6
SHA1fcc549391579ba5c5635d74dc3a7b40ca3dfdcc9
SHA256f01f41e279f8137f3ff647497b3e0a8e5731ada0c6bf3ce07d06584d49b2e0e8
SHA51233f12e45e617a394b47e8a00f3c3e52861d82d7d73daedd9e873fb3a10d98110df9ad7a9cbfbea9ea755bb622ba0d639f7b5024af36e2e323a89f4e29b917ad2
-
Filesize
64KB
MD5de0f61f6541bbe1c1a46e4326c567d34
SHA127d091a847eefdd540e9da200c19b4be32bba51a
SHA2564ccae38c6d86d5d84b79952a0583333068d33931e7357b8f61e254605712a8d8
SHA512263d879e1e21b0895483878e0a3a7856b1e289571f32defa754d5bdeb27c9c3ff3091f702b3e7c0feb2e41c0e218607b4e7405d92ac08c048bb4f1efeafe7448