4a19a153544c76c78a29fbc2a8cf2e64824ae39cf6d32efd6effe16c325f406e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff4015bf4a75a9e063d94faf61a2e3e1_JaffaCakes118.pdf
Size

35KB
MD5

ff4015bf4a75a9e063d94faf61a2e3e1
SHA1

0923e89823ae1238710f5f30e0b777a8fda7ecc6
SHA256

4a19a153544c76c78a29fbc2a8cf2e64824ae39cf6d32efd6effe16c325f406e
SHA512

af92f277fd7d02b2ec9ea91f7e65f6c559b41a0981dccb0305ec9db62a5391a7812da4a4732436d77c0ecfe51ca81b642a79ff4efdc86cdd451ce0f2f11682ca
SSDEEP

768:RxwZRVxAeZsKWKnCuMkMitw6uPnXyWUwfWVN2lVyxW8l9qbJZvcX9Fu:RQRZWCDMkXSlyWuVAlVAl9qbJZvcXm

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\AdobeFnt16.lst.2260	AcroRd32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\AdobeFnt16.lst.2260	AcroRd32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobeFnt16.lst.2260	AcroRd32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3600	2260	AcroRd32.exe	87
PID 2260 wrote to memory of 3600	2260	AcroRd32.exe	87
PID 2260 wrote to memory of 3600	2260	AcroRd32.exe	87
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 4024	3600	RdrCEF.exe	88
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89
PID 3600 wrote to memory of 1172	3600	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff4015bf4a75a9e063d94faf61a2e3e1_JaffaCakes118.pdf"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=871554EC7395FCC8C37DCA605E69DFFA --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4024
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=720ACD38206845641B30C36AC9458836 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=720ACD38206845641B30C36AC9458836 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1172
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CD5F1C7A5A9DD0DD03B612B828C6BF4E --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4748
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=85B88790301101B932268508045C61BA --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5044
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=94A073172E5B417D9C48504158D62E7E --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1776
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6778F3E839E6CD758AC25C9B08308F7F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6778F3E839E6CD758AC25C9B08308F7F --renderer-client-id=7 --mojo-platform-channel-handle=2252 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ba9f4f8a7e325489fe25e3c38673493c

SHA1
4c633a0f60ac5f0bfb6e91191d64647493e2bc5b

SHA256
0a828dd38418ec54414e9578382c01d58e4c9a671f874b42fe2ef1ff06d04674

SHA512
18c1247267e74177eeb5e7e4096b8f719acc27a77b60b5a4e5ec72ad966bdfcd487f7b55fb95812dcb37d77a377bb72f4d03207903fa3ea4987b3651792e3cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4b9f141c0a5493a79f34d2781ba1ed31

SHA1
79a0f5dd46f7c42f65b55b8a5db1364bd82a0d4a

SHA256
b2f1f52b578c0a796692f510ed1ed5765462131570414fa7ce62608b6e4261d3

SHA512
d78d1c73491fd2f587da798cd49d4c5f0cec659095e695b44f4b888e9e1dbc6eb5f5bca58f37812752d0e85c2b693d8a6fc22d457b2872d58dbffd3942846dbf

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst

Filesize
97KB

MD5
700e7d6f9cfc26cea4d04f65f02b3452

SHA1
e5580200e54edb7cd4f7c5daada5c031434cf334

SHA256
c3d8aef5d450a90e4a51335532c977515e589143be772697e666c8c9f4ab0c0e

SHA512
1cafa5bab9838052312d8a6ced7d9baa4f28ef77d48681ada4dedf29400d235b51e187a1f207cfd8e008ee6274156cb7ef2821fdf7cbcc65d697ff4f469d7a82

Download Submit