Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 17:24
Behavioral task
behavioral1
Sample
ffc95337f0122bcffd90be4c0f89efe1_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ffc95337f0122bcffd90be4c0f89efe1_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
ffc95337f0122bcffd90be4c0f89efe1_JaffaCakes118.pdf
-
Size
41KB
-
MD5
ffc95337f0122bcffd90be4c0f89efe1
-
SHA1
34fa58f4fea471b9b037170a065226424735e64b
-
SHA256
b9dc9f2efbc2b6a52610f599fbd6026ecb0f18055b819202c11771b006932508
-
SHA512
ca8b8e1bb54bbe0769d88225d07aa1f1356d6caf3cd958fa2de8f27ed17c421245e71a697272b5a4f165e23acabf0015a498caa7fc0182da4134b416a9b13ee5
-
SSDEEP
768:69iq/5mZRe1TH4oO+J067Cv0hYbgb3Vsmg8qc9nrDrd6UR16z64P8KHs/xn:69hmZIUobJ/Cv0hYbgbumgLch5jP6z6H
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1076 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1076 wrote to memory of 964 1076 AcroRd32.exe RdrCEF.exe PID 1076 wrote to memory of 964 1076 AcroRd32.exe RdrCEF.exe PID 1076 wrote to memory of 964 1076 AcroRd32.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 4908 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe PID 964 wrote to memory of 2240 964 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ffc95337f0122bcffd90be4c0f89efe1_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=250A49D5575AB54513CF1DFB132D333D --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1D866721DAD51493F98BAB79860DF1D5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1D866721DAD51493F98BAB79860DF1D5 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=07DB8A1827B05476D6AD306A04537A7D --mojo-platform-channel-handle=2268 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA63E3116FD6B5A904526C1C6EC18C73 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D4F9E8F4B5EE227226047D1E8C89651E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D4F9E8F4B5EE227226047D1E8C89651E --renderer-client-id=6 --mojo-platform-channel-handle=2492 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9DEB858D7C85C08AAA61544D19BA81C0 --mojo-platform-channel-handle=2780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD52f33bdcfac2ca1560d95abec5fc9c79b
SHA1ef0d093ba6f52280adf09c0a08a3ce83be60424c
SHA25675edd7990f459b938f9b0602ea28a451582cc100f35cd37f9369a63f3b699402
SHA512652afe5f5c53b48b32b124853f9e7e852b81bc01196450a7e1804cb2866961882e9109100b55094e5ae703072fcb2f1208e8bb19b7de26515430b910c8835b0f
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD51b12f9098a596e12b8f854ee4a4dd24c
SHA15662c15f052f75a0127cbe61faae41a5a5067903
SHA25650be656746e94b6f4a85fa79f248b9c948a556a4275c729939f6f51d273946e8
SHA512010c3bd69fbadc36571d3737069c47c2d8ee8f2cd3c7d401ce01783d6bd1068680870e4942326872001e12b971a9f4a522a041498ef6ac16fa3b97b5c19185cd
-
memory/1076-28-0x00000000099D0000-0x0000000009A20000-memory.dmpFilesize
320KB