7d2232a11f908e9dc442b6183aac67e838222780a52ef3acecd25bd3dce20ce5

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

222c24f01a291d24dcdf7db9ab9e2c74_JaffaCakes118.pdf
Size

134KB
MD5

222c24f01a291d24dcdf7db9ab9e2c74
SHA1

b5943944fc9813e29de483002cbcb1e17c296e93
SHA256

7d2232a11f908e9dc442b6183aac67e838222780a52ef3acecd25bd3dce20ce5
SHA512

6e3b5f9742fc3ab8387bb19335b4060f7329b8d0f30a61df24a19d2386bf846640b0ae0f150dd6e79d27a565bfd045089e1e64f7172fda64366eed6616146538
SSDEEP

3072:CCoSmsrlJHdhQrfGH4jcOkPAxt7AUedBeb2s+eCelLDRmBxPd:hbm+yrRcOkO7z8MTR+b

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4124	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4124	AcroRd32.exe
4124	AcroRd32.exe
4124	AcroRd32.exe
4124	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 1036	4124	AcroRd32.exe	90
PID 4124 wrote to memory of 1036	4124	AcroRd32.exe	90
PID 4124 wrote to memory of 1036	4124	AcroRd32.exe	90
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 3424	1036	RdrCEF.exe	93
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94
PID 1036 wrote to memory of 4120	1036	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\222c24f01a291d24dcdf7db9ab9e2c74_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=245397C77884E4012D897AF6B3789C29 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3424
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=54103AF44BE3551F54A64A4C5D813CEA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=54103AF44BE3551F54A64A4C5D813CEA --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A0028E264C075CDD470FE72892803FB1 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1668
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=08C65F2645CA54FB05153DDFC760C5BC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=08C65F2645CA54FB05153DDFC760C5BC --renderer-client-id=5 --mojo-platform-channel-handle=1900 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F8AF665192F7A00192CDB2E7F634DFD1 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2316
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=883EBD64369A4F724F293B7FE0E1FD21 --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
56bf0ec6065cc3323e449afddf07cf14

SHA1
fc1721c84fb1dd6d0ed8fa1b0e2a575b3cd60e49

SHA256
1b17377cd4e1fbc1d5899933ab87d30cb4d6967a140e7c0fd7356525d7100d42

SHA512
0e60be7271ce6906d36edae4c0047721b80b408fab97018607181714505756715b50c0a99e3df665a72b777def680d365c0a1ee4851cf7ba9c7f74c21f3487ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
7bdc5b65ff42b4b5b0db98e235dc2a44

SHA1
acca901c8fa47a8bd1675d1dc10c17c91b6152a9

SHA256
9bfddeb71093056b75005eef2a34bb72021072f24f8d52ae4f52beeab955000d

SHA512
6db02511a0fb75363d9d7b18b41ace27adb9c519c27136c49547e0994efc0b3735ef9e92fcb9514475938c46d865b70ca6f9a2182d133292f8d7943cb645f20a

Download Submit