6286be0f114e1a2e7992b724f4bf10c2c01f784c201412116ab1ff8012b17cd4

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01de522c0633013467a42838fd0cb218_JaffaCakes118.pdf
Size

81KB
MD5

01de522c0633013467a42838fd0cb218
SHA1

20ca611308466a3d3d42f7d84f8df5d9edcbd823
SHA256

6286be0f114e1a2e7992b724f4bf10c2c01f784c201412116ab1ff8012b17cd4
SHA512

7f74ecd93b640cac34f12862ad7e8cedfead2167607583545bb4bcdf9500f2e73a70caf5e7be535122c7af453e280cc142478ca96af31b5d8b9de2a914f63e4b
SSDEEP

1536:ESY89WKmCm4ZfqNyiVYYXb+LGf4R5TeT+NEWGpOKCWy6Ksvt40tE+aKEaFOK:S899mCbcyiykf4vTeT+zKqsvLtE+6aF

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4028	AcroRd32.exe
4028	AcroRd32.exe
4028	AcroRd32.exe
4028	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2956	4028	AcroRd32.exe	89
PID 4028 wrote to memory of 2956	4028	AcroRd32.exe	89
PID 4028 wrote to memory of 2956	4028	AcroRd32.exe	89
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 2528	2956	RdrCEF.exe	93
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94
PID 2956 wrote to memory of 1916	2956	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\01de522c0633013467a42838fd0cb218_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=50BC5188353AFEB783BD2CDC6FCFA4AB --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2528
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BFF7B535EE2835EF05FC37B326FF13AC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BFF7B535EE2835EF05FC37B326FF13AC --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1916
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=835E416D770D1807D7B806108A270E7B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=835E416D770D1807D7B806108A270E7B --renderer-client-id=4 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=20FB646FFE2E0F2E8B47351074067CCB --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2360
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=691DFD5C93D1A7CC965E5EA18BAC97B6 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=952FD79CDCA5C6C7384753806BBB4781 --mojo-platform-channel-handle=2484 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
98264977a5147268edd3670a104fc182

SHA1
e4f5cc01f767403ddda9f115da3afbf7c3391d11

SHA256
c39a9afa4ececca23c119cc37aa4b1c60f1ae61198d605f687a8cff86cbaf274

SHA512
17e56b837b7ce3d02dd29e66078610fc15cb4074fb6620f6a9d62175976651e05473b0d49c9ae2f4b82097d23942758bec1de526127151b34ef28f0d09930af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
58aef9a155a3539540e69732a2fe9a42

SHA1
ba41161e8fca58e6f8e6db4297c023b8d4318fbf

SHA256
8178e1dff036e1c285aad0f3999b42b3cbbefad6d7e33e5286dd65352c6e9703

SHA512
39e17f40826b468bed053c339b7ba25aeb1c0fa438a1616b69e6d792d93d7c6f6a9d600ba565db34ec2b8c0478392afdf4f1f8d156bb6ff6411f9605db05525f

Download Submit