Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 15:43
Behavioral task
behavioral1
Sample
924f7cfe0439dfac1f6fdf504676b12b_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
924f7cfe0439dfac1f6fdf504676b12b_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
924f7cfe0439dfac1f6fdf504676b12b_JaffaCakes118.pdf
-
Size
115KB
-
MD5
924f7cfe0439dfac1f6fdf504676b12b
-
SHA1
b290e90322c6762cefc45c43d8940ae1b37c5dea
-
SHA256
01039c8f08742ede4659b13bd7cdec85f60b51a9a4b7c4450e260357cdb8b240
-
SHA512
19274df3d2501b5bad549acc46f4681698e53908e216c7f6b45f2bff9b4bc5453529c45c5367ca4dd987d1c19103ff0b9edda06039b13fbea5d52e1977704eea
-
SSDEEP
3072:2y7Fmajsl9HYdeg/tNbY1E3BETx7sT1bppZOK4cQMUysP2:D7Fmajsl9HYdz/tJY1E3qW1b3AHb2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 228 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 228 AcroRd32.exe 228 AcroRd32.exe 228 AcroRd32.exe 228 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 1964 228 AcroRd32.exe 88 PID 228 wrote to memory of 1964 228 AcroRd32.exe 88 PID 228 wrote to memory of 1964 228 AcroRd32.exe 88 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 4116 1964 RdrCEF.exe 91 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92 PID 1964 wrote to memory of 2764 1964 RdrCEF.exe 92
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\924f7cfe0439dfac1f6fdf504676b12b_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BFB352FEEB19D200E0EC3037D071CDD7 --mojo-platform-channel-handle=1680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4116
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DB02B358B84CD3EED153BB68A8551262 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DB02B358B84CD3EED153BB68A8551262 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:13⤵PID:2764
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=68F95A861D95313F27F87EB8A17317A9 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1816
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5EFAD0856A810A0A1991B370B6FC9357 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5EFAD0856A810A0A1991B370B6FC9357 --renderer-client-id=5 --mojo-platform-channel-handle=2424 --allow-no-sandbox-job /prefetch:13⤵PID:740
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=91CD0C71DC496CAEDE100AC5EA44CDB8 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3764
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E3FB8F03625557519FEDF11EC80885AB --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2204
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d5315df02fefb9e22f2d3dfa1f9f4259
SHA135154b4283146eb68b92883b279ca2399d6ed8b4
SHA25657da8792e8748f5e4522bb5b6492a6ac04b7547e7623f62ced9126b271d1f1bb
SHA512b2aa0f1b64a713c3bbaf0d7d09a0b86597653156152820a9a7412e152836e345a2553cbc823425a5a2185e26f38bbe62f2df331d89f5693666a7a53f213436dd
-
Filesize
64KB
MD558a9558cd3a4d058e4f7df3969536340
SHA1258ab0bdd8e62d1d08fe73e30e9f520719d812a0
SHA2560c1fc28ee63cc3f988c45934e1d6c5bdd8b28be9339426e85ec28a134bb7d7a4
SHA512933a2b90edb1df18aed37c457eb75af8c740109992f8dcbcb47ce4072afab20b66561f404e49304d786a1407eb5974b86768641904051870d5bb52e02895a2e4