Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 22:50
Behavioral task
behavioral1
Sample
0b135583c2683c28ba2962b999839281_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b135583c2683c28ba2962b999839281_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
0b135583c2683c28ba2962b999839281_JaffaCakes118.pdf
-
Size
86KB
-
MD5
0b135583c2683c28ba2962b999839281
-
SHA1
8e8196555f730661a446da74f1d5c910b2ce8175
-
SHA256
9b0af15ee3e21bedadb6ade2f9df5a44e2c912dbc77d75c3d0c1bbcbe2737cce
-
SHA512
0138ea911bb11bcb98a4175263ccc44a7b449d54ff1ee07192bebda3bae3fd4c660ba25612c79ca08a90ccab3e338efc3f7d7e4e6d6215d4bff4f21dfafdbec3
-
SSDEEP
1536:GXXtoWMELxK2vN30Bq3XCNAK5btp/y6/vgzPjoVL5Wku2JGxKkWQXWkpOTW18:6XH9hhiNA8bT/vkoRLwxdWQWTD
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4864 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4864 AcroRd32.exe 4864 AcroRd32.exe 4864 AcroRd32.exe 4864 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4092 4864 AcroRd32.exe 83 PID 4864 wrote to memory of 4092 4864 AcroRd32.exe 83 PID 4864 wrote to memory of 4092 4864 AcroRd32.exe 83 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2068 4092 RdrCEF.exe 84 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85 PID 4092 wrote to memory of 2864 4092 RdrCEF.exe 85
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0b135583c2683c28ba2962b999839281_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F8CF40B665D2A8738789C4B6FCF4F6DA --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2068
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=87B0B2639D2526B3536486EABB1CF1B2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=87B0B2639D2526B3536486EABB1CF1B2 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:2864
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B0610B6804B2EA0989A8616D6B83631D --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2536
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B3BF57681BADA9484CEB7DDC641FD58B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B3BF57681BADA9484CEB7DDC641FD58B --renderer-client-id=5 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job /prefetch:13⤵PID:8
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FB3B851252BBB6A8DD0BB9F3558D897A --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1468
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A150DF19953A2F3DA5EF5BCF5AB26D0C --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3308
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5933c26e9c1142e477f961fafd20822b1
SHA1480d7ce4cf7613d7537d0632418ec6b447dc186d
SHA256c3415e32cbc75a337971f561faa5c54286e798cbec230cce2cad4e5adfd869c7
SHA512c9efec0d64bf15b6e424fd294616d9820dc7bc4835ffc0f51e7be499300e6487066f2bb0a0e3ab6081e10124d41bc19d489733b5f95cc2160db88409132051a5