Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 21:40
Behavioral task
behavioral1
Sample
7aa06617cf9ada99de79ff1622862c9f_JaffaCakes118.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7aa06617cf9ada99de79ff1622862c9f_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
7aa06617cf9ada99de79ff1622862c9f_JaffaCakes118.pdf
-
Size
33KB
-
MD5
7aa06617cf9ada99de79ff1622862c9f
-
SHA1
f8c8f91a0a7e807cf0a8d378ed6a4cfb35a900a3
-
SHA256
86f111985a932b52c58796c449d6915e1f1189a53a43ff47dd8996dc2f541b7d
-
SHA512
a92dae0f32050c47e38902712454ed1ac6a69e450d1f012d05f8daf17f24bf641c1b13e9a7f5ebe491c4590f35a14d531a844a79ef46b4367be0546fea9ad82a
-
SSDEEP
384:IO/QON8MUG6Qgw0JZCTzz02YFnarXk3ajCXyJamk2FsMDx4upVqo3usTS9n6/JvL:zXuMZmwgCLWar9amkepDx4NK0bq6PEr
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2020 AcroRd32.exe 2020 AcroRd32.exe 2020 AcroRd32.exe 2020 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 4716 2020 AcroRd32.exe 92 PID 2020 wrote to memory of 4716 2020 AcroRd32.exe 92 PID 2020 wrote to memory of 4716 2020 AcroRd32.exe 92 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 2444 4716 RdrCEF.exe 95 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96 PID 4716 wrote to memory of 3096 4716 RdrCEF.exe 96
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7aa06617cf9ada99de79ff1622862c9f_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4E1EBFFB7068F3F620ABA84862058027 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4E1EBFFB7068F3F620ABA84862058027 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:13⤵PID:2444
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=397C87F83A4EF3CBACE6EDDBC975AE64 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3096
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=85B0082C77EEAA75D41236C5EAA80885 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4244
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=66E55B7338BFA9EB5D9E53B56927B643 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=66E55B7338BFA9EB5D9E53B56927B643 --renderer-client-id=5 --mojo-platform-channel-handle=2000 --allow-no-sandbox-job /prefetch:13⤵PID:4952
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F8ECDAA35C447CC2A56010A94C4ED278 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3760
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6F3F0FD5B46D7B4FEA84A8E0126FAFE5 --mojo-platform-channel-handle=2764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4868
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD51ac9ca731635ed1900be38005020ea4c
SHA1f81321bfc636b03d72243a19572979eee5f88767
SHA2567eabe1581accacd014a19e232bcc89902d9048b2bd73dcc8b155a5297155a6e9
SHA5120eee3c48c59ae1c6f12505dc428ba4460d17b257674fbb22810d6767e03b71acbc2ddbb89238f97ed873317e8d80538866ecce4eea116f7ad394278c266e5c17
-
Filesize
64KB
MD52174106e37236331c50a0fa32dc7be0a
SHA139479fd5eb029f9266589de6ec0c52a7d64c9575
SHA256916025ae3c1203b493d5d7964f52668b0b7900ddaa7e501838c2f2e4d3b1302b
SHA512952e4d82c5bfd981004caa5023d7b0e954cc367e2f030dff583df07cac28f99c37247f8966d933327530c834a4de880189cef8fe2a28e7f19a5fe165c48d1865