1e3762545ec96125e17481465fb20fda39f28299555ef9a3fba655fbc8f91a8e

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0024262b8b7f1c51365b0d17b07ab2e7_JaffaCakes118.pdf
Size

78KB
MD5

0024262b8b7f1c51365b0d17b07ab2e7
SHA1

ec82766f62949081f21b8a0706bbd771f1da032b
SHA256

1e3762545ec96125e17481465fb20fda39f28299555ef9a3fba655fbc8f91a8e
SHA512

5c0d8eef0956cb2aded9b571f65bdb516a610b255e5b4d1cc3ce8219c043484a89e83ff6b3ce2d59030c32093ee4989a593b5c8d1b387dc343880b5d73827d68
SSDEEP

1536:O0DYfbDu4yhc8aKfOLIJJEJvF16h9d+UgTWyZVNLDSt5YHrW+p1edxbWcpOmUCd0:RDYfXY28aEkIJAFA8UgTXTxDS8HV0za7

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3320	AcroRd32.exe
3320	AcroRd32.exe
3320	AcroRd32.exe
3320	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4596	3320	AcroRd32.exe	94
PID 3320 wrote to memory of 4596	3320	AcroRd32.exe	94
PID 3320 wrote to memory of 4596	3320	AcroRd32.exe	94
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 2932	4596	RdrCEF.exe	96
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97
PID 4596 wrote to memory of 756	4596	RdrCEF.exe	97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0024262b8b7f1c51365b0d17b07ab2e7_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4DEA7046DCE58449FDB2B2273F26B7B2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2932
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F69FF7446054430232D76694F102FBD9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F69FF7446054430232D76694F102FBD9 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=65147A9AB2651A79ED7334A73FA4E65F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=65147A9AB2651A79ED7334A73FA4E65F --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=192184D58E904A7C256C290BCB23DC8E --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3876
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DE104B1A8D4EAA2403DC2CE97124561B --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=49D27D8D0E2D3CE80B84F3FFF1DCF250 --mojo-platform-channel-handle=2148 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
381b85afea8e0283007df56b3c5c0689

SHA1
f8540f70d5e2d6fbf6192e0212110bc0daaba09e

SHA256
d01031599e4c9068e611f65887b6d178325eb23a42e2d5447c8fffb9c326e27a

SHA512
fd531d29698b7f841024d0184703af38362624f4632b1013c7eb6fd3239d848497708c599508c6abd82ba78fa67ec45ad9c823ee179a31621836f26157aeb90a

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
10cdaa899157ea30b893304b1a3bc978

SHA1
01034cd4e3c6846c8a4a82bb8025ad1de554333e

SHA256
48f2c28e6c11539b0efcb7840b35b083e0a9e50967ead56270fdf26853caeecd

SHA512
d3ad2494debbbdc13b10a1011db0dd163335f2bd1dcb6cc8d79681662186f064f02beee8eee30f47a5ae30a96d42752dfac6eed17286bd92eab1df31cd6e7381

Download Submit
memory/3320-28-0x000000000AFA0000-0x000000000B24B000-memory.dmp

Filesize
2.7MB

Download
memory/3320-30-0x0000000007980000-0x00000000079A1000-memory.dmp

Filesize
132KB

Download