Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 04:35
Behavioral task
behavioral1
Sample
745771ac25a11adbb98527c39e9aeeb6_JaffaCakes118.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
745771ac25a11adbb98527c39e9aeeb6_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
745771ac25a11adbb98527c39e9aeeb6_JaffaCakes118.pdf
-
Size
49KB
-
MD5
745771ac25a11adbb98527c39e9aeeb6
-
SHA1
aaea37a63e156678fbb9caf6ea6477e726a81342
-
SHA256
c626f668b8c43391d9c553f04b25791183f7f808b09fb3be2984cfdb21b6fed5
-
SHA512
5752d6d39ebb81ed94093fb42afde8ef3572b2511af19a86c6c4da5656e8fe25cf5bcb1f501bb6b12e435a999772d215e87fb2737c3449a8aaa81b4b19770b09
-
SSDEEP
768:PgGzpD7hgiXpbeMGfEo0UGCfXw9TQ+OcRS5ce34kjJiLbVoPF34n5CfFme1axz/J:4GF/14/Xw9TNS+eRiLbSOnMFmJxfvCRs
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4564 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4564 AcroRd32.exe 4564 AcroRd32.exe 4564 AcroRd32.exe 4564 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 5036 4564 AcroRd32.exe 95 PID 4564 wrote to memory of 5036 4564 AcroRd32.exe 95 PID 4564 wrote to memory of 5036 4564 AcroRd32.exe 95 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 3740 5036 RdrCEF.exe 96 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97 PID 5036 wrote to memory of 4064 5036 RdrCEF.exe 97
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\745771ac25a11adbb98527c39e9aeeb6_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD4EDA3CF3C1150AB8B10A36721EEBC6 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3740
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8D0337EC1F9757CCE30775C1AAD2ADEA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8D0337EC1F9757CCE30775C1AAD2ADEA --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:4064
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E5F9BBA466BA0A24092BD363BD482FD4 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4428
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=21489BD9C96705AE76C8ED259387B50F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=21489BD9C96705AE76C8ED259387B50F --renderer-client-id=5 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job /prefetch:13⤵PID:4932
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F49050AB4B622065B4747EA5F3C349CC --mojo-platform-channel-handle=2704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2288
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A712AD9FD9D91D42AAF2B6FB6AF584F --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1932
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD511b3804ae8dcabb2de9081f30803d83e
SHA1b52adac12f41a9e0ef4eac56e402cfcce2befb66
SHA25662d3e4c97392f4c71699e2e2aa880561e4c3b309ed1abd6e9b85cd66297a1e2a
SHA512b8f08ace4ab8e38aaab7fbc64ad48056b1d42d0c32989812d9a80e5f4a542edd1f620d51e18b2ac15f0cc78c8f66178fc7d21653bb39709c982232120ba189e6
-
Filesize
64KB
MD5a891dc0419141501ae13697fee0d4ae4
SHA145ada8b65f50417012cafe2dcd72cd21d1db85b5
SHA256ccc49f1b60aa66ef39722f92ca10db7da2f6bbc272b61e7e1bd8e3397dc58cd9
SHA5126a9df5cba0dcc02e0bba666d493a48865a29bb37696d92afa295fa295f003f20c039766169dc41421ba93c2354140fa55231769c7cafe359d1fe4771b938cfc9