28a7d44329aeb1da656f64e5bbc40e73616a2b07aac57830be01e0f3b9613225

General

Target

ffff351cd42fc486375857536fe000d9_JaffaCakes118.pdf
Size

91KB
MD5

ffff351cd42fc486375857536fe000d9
SHA1

7702e577b6f63c55c17f780b102e4813cc6cbdc6
SHA256

28a7d44329aeb1da656f64e5bbc40e73616a2b07aac57830be01e0f3b9613225
SHA512

93e3af0e6c121d822e34c0106a370bc26d6a25b5e47619caacb705fd4aee1ae1b2fb180ccbff8766a9a93340342f1b8162d1dcdd1b577a76b1e2e44e99b0f08c
SSDEEP

1536:ykPPD0OxnW2aNWc8HDHbY93KB362dRa+R69R2hgczB5gWapOtQHWhrLSqGQasB5t:NnooJaNL8HDHbY938dRavR2lB5ZtQEFf

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1412 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1412 AcroRd32.exe
1412 AcroRd32.exe
1412 AcroRd32.exe
1412 AcroRd32.exe

pid	process
1412	AcroRd32.exe

pid	process
1412	AcroRd32.exe
1412	AcroRd32.exe
1412	AcroRd32.exe
1412	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1412 wrote to memory of 2276	1412	AcroRd32.exe	RdrCEF.exe
PID 1412 wrote to memory of 2276	1412	AcroRd32.exe	RdrCEF.exe
PID 1412 wrote to memory of 2276	1412	AcroRd32.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 5044	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe
PID 2276 wrote to memory of 3276	2276	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ffff351cd42fc486375857536fe000d9_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F3D8842BD3F139694B11377588957D8C --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5044

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A12AA9E2165071642CDBD6F98F916AF5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A12AA9E2165071642CDBD6F98F916AF5 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3276

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F7886A4E6FF853E6075F686F209E029C --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5092

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C88335A632F7EDAF54CFC74F60637B8A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C88335A632F7EDAF54CFC74F60637B8A --renderer-client-id=5 --mojo-platform-channel-handle=2500 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3056

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4536A24B77C14BF2675F6ACD115D06EC --mojo-platform-channel-handle=2736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3208

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8A1ACA18C36EA7EE2E5D6337194D05DF --mojo-platform-channel-handle=2868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
86e6e1da29b5aa55e01d1247bfff0793

SHA1
8ac6df1b350dc94d7a9a7ddafc13fdd33fc41fea

SHA256
e4048013a909b8efcfad398a87573db256df87d432fbe71856a8291f46f0eb7d

SHA512
aadfd07225956bf8c8a74a6a4e16a029aa3a04779bc38129e51a350ec34bd6d4a67a21e7eb2f5eb29b286eb26a311e7aa03b0b8d77362e67d645146f5a44d554

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
bc72aa3ec51f01ac48453b4673404308

SHA1
ad700d5cddc1d52eb542f1bc9669f5544fe6dad8

SHA256
878101395a37f4b0624fbff2f14371bbd578f86616a0cc2c660f18b5b95dd42a

SHA512
e779341d3c128805a1e30e6180c953848b3a5da45461b12166e458253b8c6b3536c4f49f45aebddb7192fea8b0b3a726d78f24561b3487a0fd369f0184ce1e27

Download Submit
memory/1412-31-0x000000000B880000-0x000000000B8A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads