694628cdc110559d659bc0843dee7155365b41b969a2dbf319328020b7fdb956

General

Target

ff969933fd22ab1f921f8e6d55e9bb30_JaffaCakes118.pdf
Size

87KB
MD5

ff969933fd22ab1f921f8e6d55e9bb30
SHA1

5e90c22d9ac25cfdd40604fb43ec1a05a86741a1
SHA256

694628cdc110559d659bc0843dee7155365b41b969a2dbf319328020b7fdb956
SHA512

7243515df629fcb6b0e29c8e7f3ca126597547c0b0e4b7d39b7ceaa3458aa280bfef67a12ccef22db69cb96d92deb9b9a23288ede277f6e3977aa608abd521bb
SSDEEP

1536:FidusqclKbmNGUoCT9WT61O4x2wjffcmUTETjYUWapOtQHWKMKIMdxjXeVhpr:knsUx9RO4x3ffbUTH1tQNCH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3448 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3448 AcroRd32.exe
3448 AcroRd32.exe
3448 AcroRd32.exe
3448 AcroRd32.exe

pid	process
3448	AcroRd32.exe

pid	process
3448	AcroRd32.exe
3448	AcroRd32.exe
3448	AcroRd32.exe
3448	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3448 wrote to memory of 4128	3448	AcroRd32.exe	RdrCEF.exe
PID 3448 wrote to memory of 4128	3448	AcroRd32.exe	RdrCEF.exe
PID 3448 wrote to memory of 4128	3448	AcroRd32.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 2592	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe
PID 4128 wrote to memory of 1696	4128	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff969933fd22ab1f921f8e6d55e9bb30_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4128

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EAD1DDBB801A2138AA9A98ACC35E6600 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2592

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B1C01222D76BB626DE2AA95571D5C8CC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B1C01222D76BB626DE2AA95571D5C8CC --renderer-client-id=2 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1696

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4E449C5C4A330C1BBBEB8BB662070CB7 --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3400

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2AED1CACD65D99A030A710D00A4589A0 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4160

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3581571C39366116234EEA51E5F73AF1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3581571C39366116234EEA51E5F73AF1 --renderer-client-id=6 --mojo-platform-channel-handle=2252 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4028

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=826F76305801F8BD8730C865E52BE9CF --mojo-platform-channel-handle=2536 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4209f44bde8814692bf91ebb5baeb8e7

SHA1
8c38b395cf6cc65351134237ddb06edfc8ef1e90

SHA256
1907a50ed9db52d802e95f292bd3b84b1daf7b43c46262db5e5d4c907201666f

SHA512
129eca669d870f9c7bbd6175f7f3dd912d76f401ab086bae8a17f5635e54953edffc3245a9147c6c448a8a0eee111df7c6f21553fe625b2fccad8ef64da3b0d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
d0de1bb7e36019c0258b2739c3cb2fea

SHA1
27879400134c4851007787c558b5f0cbc3543495

SHA256
4110c7dc9ec3ed3764bdbf9528564c253b2238090bb8e7acdc2b41b19ddbcf9e

SHA512
8f93fa84bd05d4e2d1cbc99147c4ebe52c6bcca734fabf8862a2746adf956896e4fc54b1eb7c62c4a832514051b3529eac780453cc76d99911cd7ba1ca306362

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads