8ff7fc45368b7a28d58acd082322ff0b26a614436fe47692aa779483f485cc68

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc7eef2b52100c4fd446ff7dcc82d733_JaffaCakes118.pdf
Size

71KB
MD5

bc7eef2b52100c4fd446ff7dcc82d733
SHA1

8cf38eb6536583ffd2627063fb21a1e5a84bfa3d
SHA256

8ff7fc45368b7a28d58acd082322ff0b26a614436fe47692aa779483f485cc68
SHA512

7c045c1c36eb878b11565ce91ca11eb817c5474fb669d4ad3294fd6274ac0f51ab8153a917729a2502d56baaa433a8b884b0479922c65a856d4cea2c0b5a4ede
SSDEEP

1536:s05BgKX4RnjY6azI/Lr+etJfS1CWubUviu+FyKpnWjTW47kgEWQpOCX9y:/injY6az+Lr5j65iWL+8KpkT37kgDCI

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3992	AcroRd32.exe
3992	AcroRd32.exe
3992	AcroRd32.exe
3992	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 868	3992	AcroRd32.exe	87
PID 3992 wrote to memory of 868	3992	AcroRd32.exe	87
PID 3992 wrote to memory of 868	3992	AcroRd32.exe	87
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 976	868	RdrCEF.exe	88
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89
PID 868 wrote to memory of 4064	868	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bc7eef2b52100c4fd446ff7dcc82d733_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=01B9792C2252A28AB50AE15607A5EC8B --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:976
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9FD5A3D7DCE451E5113D68CEDA8E1C6C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9FD5A3D7DCE451E5113D68CEDA8E1C6C --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0210EE646B5C686514EC43C3E01E095E --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2352
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9E5ACA34DF0985F5D8D93848EB50006B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9E5ACA34DF0985F5D8D93848EB50006B --renderer-client-id=5 --mojo-platform-channel-handle=2432 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=21C51109CC5C679EE22F6AED1EB1F11E --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1344
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E4704A60381FE79B0C0D0939AB527B6 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5a61ec9dc5ef5a6991bd2b947a07c8b9

SHA1
fc29047b410a0c2dda981e81f8ceb5a44cac2bbd

SHA256
72d353c27419ef9870708cae641e8fa420c38cc48bed37b067d96bbfe40b9c9f

SHA512
b7176eefd131e918809a85a6ee14a1098826cde4719e7c8368651f2a748b443a2c580fc2ceb845ada059512eaa712d97509dfe040ce2412eed806cce947de2ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
cf54f0e93f57a111e28d35444321889c

SHA1
84c09dd6807ee9d21b1961771d93dfecec8462f6

SHA256
28ebd6e5aa6aeee2d4e491d5ce4d5a793250530435a2e7d24fad856e1ed63e9c

SHA512
9fa6fb03ecd4f76eda858a9349148f75950ed44b2ea823bbf58a9af4db91a211c729030ab84568937e83ed26be6589963898bb607c442df08be4bd44daccced1

Download Submit
memory/3992-31-0x000000000AA90000-0x000000000AAB1000-memory.dmp

Filesize
132KB

Download