80496e0fbf389f19f0916b2ec3e989d0b29161ff0a3d9b430d1e55c74d34402e

General

Target

ffe1ab66aa1f5fc73b211aa12c2e59bb_JaffaCakes118.pdf
Size

73KB
MD5

ffe1ab66aa1f5fc73b211aa12c2e59bb
SHA1

e40adfe964eab739116733018e1cf94d65f2f9f7
SHA256

80496e0fbf389f19f0916b2ec3e989d0b29161ff0a3d9b430d1e55c74d34402e
SHA512

aa5d5d22e6fa0cadc754b1e817379c849a6b56c40f5bef4c77ff663e295e0eba2f1c2a5ba498b1b4f3adb1d919003f51061ef841fac03ef7afc06aef3d1ee2fb
SSDEEP

1536:fc+mURI/bZnv5OL6oa5LWOpOwrl+fWWw6LtS6fBfjF31Q:EzUR0Nvu6oa5owrwfzzb8

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2536 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2536 AcroRd32.exe
2536 AcroRd32.exe
2536 AcroRd32.exe
2536 AcroRd32.exe

pid	process
2536	AcroRd32.exe

pid	process
2536	AcroRd32.exe
2536	AcroRd32.exe
2536	AcroRd32.exe
2536	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2536 wrote to memory of 5612	2536	AcroRd32.exe	RdrCEF.exe
PID 2536 wrote to memory of 5612	2536	AcroRd32.exe	RdrCEF.exe
PID 2536 wrote to memory of 5612	2536	AcroRd32.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 3612	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe
PID 5612 wrote to memory of 4736	5612	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ffe1ab66aa1f5fc73b211aa12c2e59bb_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:5612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=73F35D601040405C28BD07AAE4148B91 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D87671F39646240133FB371745CD4EAF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D87671F39646240133FB371745CD4EAF --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BF7A73865AA89998F9D7CE77EAA8A09B --mojo-platform-channel-handle=2192 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5596

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=164066C6012C4649FC1F6903AB78BE26 --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2424

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EE3C8E6836059475E62E5D6823AE73F3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EE3C8E6836059475E62E5D6823AE73F3 --renderer-client-id=6 --mojo-platform-channel-handle=2260 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=148135FED5D0534A6FF0BED7A468DDF4 --mojo-platform-channel-handle=2700 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5356

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
b1a3a0a93758f0f4e02f3466d1905957

SHA1
30fbdf5c4f71c369c635a9b9f23456c239a5bfd8

SHA256
0d9fd98993e32b768e91a85bac7e787716a0620db03d5a5fcf7f027e06b8fb21

SHA512
18160074ee61f9fd372353f9f5324d3c2fddc1b6599fabf62e39e18dcc392745ddd484fb43a546c547888126405be509bdd79859b5b7a2eddd3b9297909893ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
8341de7bda423c3453dbbb8844db1846

SHA1
04caa14371546dcd97bf87f7b7024da09ffab92f

SHA256
6313a2165acf89e07588daa90355d65645abbb2af8cd87f665e586c48220c666

SHA512
012a6525e355dfc1f4756ba916c1633216f7fdc22fe69e1ae43ea95919d08b15de351cce75fad451f05b63fb4a2424d5cd6b3771ebd1da55ad305b2af5010c53

Download Submit
memory/2536-30-0x000000000A9F0000-0x000000000AA11000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads