Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 03:48
Behavioral task
behavioral1
Sample
24872e3cf055623b0628a5b8178f6692_JaffaCakes118.pdf
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
24872e3cf055623b0628a5b8178f6692_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
24872e3cf055623b0628a5b8178f6692_JaffaCakes118.pdf
-
Size
82KB
-
MD5
24872e3cf055623b0628a5b8178f6692
-
SHA1
4a7d71490dc5f3572917e9a8a4985a3912f447fc
-
SHA256
1b10dd626e243e62d1bfee08147091e91158f14d5a145eec1f53fb742b880b63
-
SHA512
dbaea8e916a9923bf3b5d2d765b72236ca5c2956d086f6810fb258d0309114d6c3bd987fd23de1734b8e086d85dceff1e41ccbaca09c3d50a35043b643660ad6
-
SSDEEP
1536:2n9sujyzeyomcv3YiVdUPHoQCiHo4q1zkCWxlJjHfz+jg72Mm4W0xekzWQpOCh8T:GsuceZvZVCPHoQG14blBQg72WW0QkeCe
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1348 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1348 AcroRd32.exe 1348 AcroRd32.exe 1348 AcroRd32.exe 1348 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2124 1348 AcroRd32.exe 81 PID 1348 wrote to memory of 2124 1348 AcroRd32.exe 81 PID 1348 wrote to memory of 2124 1348 AcroRd32.exe 81 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 2448 2124 RdrCEF.exe 82 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83 PID 2124 wrote to memory of 1068 2124 RdrCEF.exe 83
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\24872e3cf055623b0628a5b8178f6692_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C4646AAA1118B2A479849D54F07D3591 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2448
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FC4C60267EDC3871B0F91B99BE3526C9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FC4C60267EDC3871B0F91B99BE3526C9 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:1068
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2537397EF78E841A8C5E113915EA37B7 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2776
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7FBE1FCC6B132B7B9989A72BAAD0D6A9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7FBE1FCC6B132B7B9989A72BAAD0D6A9 --renderer-client-id=5 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job /prefetch:13⤵PID:2620
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=68740CCD0F22E092E3C74A91197E734A --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:380
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2CE03EFC469A36901F335CAD384F8B03 --mojo-platform-channel-handle=2772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4768
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD53868aaa37ff9cc48a764495b09010fca
SHA15791de64fccc3dd95cfe6ba2259602dbfdc9fcb8
SHA25679df3e282d1b4d046b86de28fec0a88919c43d8e155d4b16e23252e1dfca2302
SHA512b3bd067038243968761bc24756b8be52325c025e1eb07d64af2908a783259deb13aeff0162e1dbf75b8ac905dda86e979a3dfa819dc9c3d4fa80f04afb254a05
-
Filesize
64KB
MD54179a997d8e8d75fcce0724a65ccbd07
SHA11ad40557a1cc3213d21b0d1f0671c9359f9a2789
SHA25617051703061a1525fd947ab19caa143c04d4038703714a8b31dda0bbee165ae4
SHA512307d51910cf2393a032d9e4448d6f33776934fce67e4bcf2d35d3f5eb7b0ee0fa2ca22d6cf1e7e2cc5def6aacedf0037c142990ad8f1cbcd159f47978822c4c2