Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 21:50
Behavioral task
behavioral1
Sample
a28d41d8f643e785ba839ac2493a8977_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a28d41d8f643e785ba839ac2493a8977_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
a28d41d8f643e785ba839ac2493a8977_JaffaCakes118.pdf
-
Size
48KB
-
MD5
a28d41d8f643e785ba839ac2493a8977
-
SHA1
a6d751fd7ad68192815ee2b6f869920f881ce3fc
-
SHA256
3135fc38d1bcd19d57d009165472f8398dd841cdeaffc752b7ea3410a2f3f5af
-
SHA512
1d99638cd460ee46bcfd290d7535b74d4792788a30e09d6ade8bc9688b781e2a6dd3d3ee050c125a563db58bc1214fa9b364830024e9ccf42fbf49a13840f159
-
SSDEEP
1536:eGFkm4GvD7w3vNQlClZLpUkaKMxevLuovbmk:HFkmJ7+m01UqMxOLhvbh
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2312 AcroRd32.exe 2312 AcroRd32.exe 2312 AcroRd32.exe 2312 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 4556 2312 AcroRd32.exe 86 PID 2312 wrote to memory of 4556 2312 AcroRd32.exe 86 PID 2312 wrote to memory of 4556 2312 AcroRd32.exe 86 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 4444 4556 RdrCEF.exe 87 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88 PID 4556 wrote to memory of 3388 4556 RdrCEF.exe 88
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a28d41d8f643e785ba839ac2493a8977_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9D7F49B148F330BA0DCBBDCBF2739797 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4444
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=23D6E0A4E8BF1D37157B34FE1F5C4FC9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=23D6E0A4E8BF1D37157B34FE1F5C4FC9 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:13⤵PID:3388
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=393221FBEA99F46F9B0D4AB4F997BDDB --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3556
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B501D335FA038D1321704320A573C0E6 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3684
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FA7C7DD7AA285ACABB7EB97E8E045DA0 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:816
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EC876084FDE86C2DFC9806FB84F04FEC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EC876084FDE86C2DFC9806FB84F04FEC --renderer-client-id=7 --mojo-platform-channel-handle=1936 --allow-no-sandbox-job /prefetch:13⤵PID:2040
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e31dcfac8b3e918758965d1f12a2d222
SHA194f85d2c156553bfba5b99bcf1aeaee23d5df95d
SHA256004febcf7871981066ed8db423fa2c5be07a6ecc7a7bf7fb2e2de54ff43ddc60
SHA5122ef2789981e93ffdac41251e1b15bd1309d690a03b2dd7fba2ee7835f769c6f8c96c9ed0f4a2e711fc357ef47fb50248a8d2fcd7d86b83637b36aab87dfbe0fe