02cd6394c1700dbb442719fe7c105b3a285db551d663aead2ea6cf949ac301a3

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e933bc36707172a726e70d19e192a32c_JaffaCakes118.pdf
Size

95KB
MD5

e933bc36707172a726e70d19e192a32c
SHA1

2a667ab9e560789f0477778b39cf51370fb5861a
SHA256

02cd6394c1700dbb442719fe7c105b3a285db551d663aead2ea6cf949ac301a3
SHA512

942db4c05aece2088b997a52c3cd1999d5af27458ec64abe8aa03e804c02bf98035e6d5bfcd39d5e00bd6bd33a429c4283d65233d6325bf1775fe46fe1465602
SSDEEP

1536:IjLx3ziIawpNXxwTN5WPmGQJaywA/1ppj6WSGk6nMCjWspOS1mC:6Lx3WInjOTN5WO2AxjpECWS5

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1804	AcroRd32.exe
1804	AcroRd32.exe
1804	AcroRd32.exe
1804	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1428	1804	AcroRd32.exe	91
PID 1804 wrote to memory of 1428	1804	AcroRd32.exe	91
PID 1804 wrote to memory of 1428	1804	AcroRd32.exe	91
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 2552	1428	RdrCEF.exe	94
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95
PID 1428 wrote to memory of 688	1428	RdrCEF.exe	95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e933bc36707172a726e70d19e192a32c_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B3B314EF29B0874BACBF4401B3284817 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2552
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EF28F328B00A1D70907EE2E675A83F01 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EF28F328B00A1D70907EE2E675A83F01 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:688
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=27A7E8CB416BD1C527A377396670370B --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:724
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6C48758A94EB343CECB183BF6303CF13 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6C48758A94EB343CECB183BF6303CF13 --renderer-client-id=5 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=68FAA614F44899E1E73BDCE5FCB0222E --mojo-platform-channel-handle=2428 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3176
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=78DB50FD011C99FC4F95873F91B9667C --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
308ce1bb0cf845179077b839249b4843

SHA1
9bdcff1fc9e31f02da38aaa3b56a8380792a733e

SHA256
fb190bcd6a9243d35e40c61855efe3dd306b9dfc84151178f21c7dadec83af0d

SHA512
5a6df30edc8f8e7ffee7d9cee803b088dd161fd306ea9acabc56a73b98c55622ed1b3c559a586ae71a57399e0fe9e22ae339efa1497c2ab8e4ab77fec75a0376

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
9d0e6aef6b1f54781e8d6750332fee18

SHA1
928c2d4f1c8b24cc44084d1a93fe6eba63feb1be

SHA256
1e82eb839c8ff3397ba7d507bffd0e0192ed38f45b76f765899c3981a357a475

SHA512
4ca57d93a4111c988d9cb35599856bff0ceb587d682e9e4b840f919a6e5630a57b08eb8d69707c928de90b94cb99fa8ddb9df3af5592a7a2a31a6824d3107456

Download Submit