b043269967334f1e641649e2cf7a9de639ebe81d5e3c2e2285fd8dff6b64d326

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8dae50425f6bba11afd2d6d29beedb0_JaffaCakes118.pdf
Size

69KB
MD5

f8dae50425f6bba11afd2d6d29beedb0
SHA1

b0488f063ab89b2fb20b115933fa282bf8ad2bd1
SHA256

b043269967334f1e641649e2cf7a9de639ebe81d5e3c2e2285fd8dff6b64d326
SHA512

2af15cc9d549b1b796475da5a200f5feb0c288e19aee7f3a3b488ec3b54ef2490afa438068aaf44df7fd8749db76eaff04bbe65ffbc6e4cf6573d7c27d281ac4
SSDEEP

1536:1+bGnoHF2uVa7zmnHJ8AhYqCtPATpH/4SRUtnII/Vg2D3:WHF2uVavaHJ8eYJ0pf3U1Z/VgQ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2504	AcroRd32.exe
2504	AcroRd32.exe
2504	AcroRd32.exe
2504	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1044	2504	AcroRd32.exe	91
PID 2504 wrote to memory of 1044	2504	AcroRd32.exe	91
PID 2504 wrote to memory of 1044	2504	AcroRd32.exe	91
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 452	1044	RdrCEF.exe	92
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93
PID 1044 wrote to memory of 1508	1044	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f8dae50425f6bba11afd2d6d29beedb0_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6604FDBCC365975BB3C7E04F460C80AE --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:452
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D5880236CC5A6DC3C3CA95759F9A1289 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D5880236CC5A6DC3C3CA95759F9A1289 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ECE6B4DBCE8BED5AFF5C142B1D87BA3A --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4184
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CE22B373AAFD69BD9279F871DB34CAAF --mojo-platform-channel-handle=2000 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3260
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F7A181EF5DE48129DE756BD59A953F98 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F7A181EF5DE48129DE756BD59A953F98 --renderer-client-id=6 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E6D3B6C4E52ABFD14BD75C991207A843 --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
b5d10d941c30229bd9fe8dec4f197b6d

SHA1
cc74d72a2c0e879f062a93f705ed3490039cdb02

SHA256
412a775a7552907aabd38c740fcd3bcda4639dedbba7eb01a979a0fdae3209a4

SHA512
872f2b4136611d534de5d714c7b0fc3fdb6d40a6dd26148dd6f20c70d545cc791a7f93ffc77ae74b33f7f6deeeea46f6a8e5fb673970af8a7333b9f13e071b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
78060b1e992b6e9a27c6e17676badac5

SHA1
327872bd98a61a9584a73bb65d7469c52108e5f0

SHA256
ea595833e13363023dde255a4f0216066e8e53800287767b6f7cb490e72a78e2

SHA512
9df81f690d6f942b9592e794a552ee5edffe569edef9966f5de4a99081b85bb25156d6f85ecb0231b572fb722186124c50069a136f6030ea8f250693de460305

Download Submit
memory/2504-31-0x000000000A420000-0x000000000A441000-memory.dmp

Filesize
132KB

Download