Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 02:15
Behavioral task
behavioral1
Sample
244ace62033c49e329ed0fa8b78da8e5_JaffaCakes118.pdf
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
244ace62033c49e329ed0fa8b78da8e5_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
244ace62033c49e329ed0fa8b78da8e5_JaffaCakes118.pdf
-
Size
16KB
-
MD5
244ace62033c49e329ed0fa8b78da8e5
-
SHA1
201fb7b267f402fe43fa69b8b13cb5373e06a7fe
-
SHA256
96e37f9c277b7c275acbd005c02e57d2bc53d9437738e4c8e283ef8f21bf2dd0
-
SHA512
83eaef3d2b923108404f7b1878d65bb85370932fd47d6b6b7558e69d4e58bcacdba391f7f71e49048ab7a1e4150e98776c1a34a79db8619106a8d9d63debc7c8
-
SSDEEP
384:4ONyCeewIjJizPvB8NnZgWF+Bh4JotmEv:XS
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4192 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe 4192 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4192 wrote to memory of 2780 4192 AcroRd32.exe 81 PID 4192 wrote to memory of 2780 4192 AcroRd32.exe 81 PID 4192 wrote to memory of 2780 4192 AcroRd32.exe 81 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 4956 2780 RdrCEF.exe 82 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83 PID 2780 wrote to memory of 3236 2780 RdrCEF.exe 83
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\244ace62033c49e329ed0fa8b78da8e5_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A2B84A101B0F65264C51E79F0C2C2FA4 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4956
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=669756020365674324C04DEF58E82F1A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=669756020365674324C04DEF58E82F1A --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:3236
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=054720735FC4464F91D9B4E96B380190 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3780
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=923C56C34D6CEC74D9B92D2DC4E6942B --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2020
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EAE54CA9FDD55C1D0BC28D5517A5D064 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EAE54CA9FDD55C1D0BC28D5517A5D064 --renderer-client-id=6 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job /prefetch:13⤵PID:4808
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=610829AFA6D2F44F084FEA24B8FFE0DE --mojo-platform-channel-handle=2808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1812
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD59f8865bd97c71ae7f8fc97d32bc5f84e
SHA1a45af6b1b93ab26aa639295a076b14a10fb45b2c
SHA25629951528510f522f95cea60ef92196ef91c3669c9a334cc0bd856697c66b9098
SHA512fae52c43640325ae464414d7304002deca6d4ec5064dbff20e7fd50e46f0ebde8277d91dbd502499a9e11c53502cc5a4400752e8e7186a7c4667a82b3581af27
-
Filesize
64KB
MD5a97154796849bff34239e3cf06924e59
SHA1b47570e18dfe5f74651473cce3f8e316465d646e
SHA256bc8364245b9a2145b10e1ccae13469b3fe258c53dd4fc255d0856ba9897af551
SHA51225b7250372e8faeaeaf1ecbbb5b1295abaaf27b2f50179d42d96d64300000109f5c5d6406c212cae6506e568f8506142fee6ccf1f64fac99bb85f2c7a726d3da