2b52a2cd699952a163f5737342e8508dd0b2c52d050584c07e78ddabe6c5d8ea

General

Target

ffef2b5c0775edc043c568261b69b714_JaffaCakes118.pdf
Size

86KB
MD5

ffef2b5c0775edc043c568261b69b714
SHA1

2c2b4e7de33a9ee47cdf4378b1e31c99966abe6d
SHA256

2b52a2cd699952a163f5737342e8508dd0b2c52d050584c07e78ddabe6c5d8ea
SHA512

1743231fdc4cd026fd539b545e7c48bc2732923361de6028142a325f1af2b81aaf7f1d91e00a151e0389eea09e1f50b22ac8e41516df905e3aef59661e11024f
SSDEEP

1536:R0MJQfKsWGMvF+9uJFJ8v0UnceFT9oprakzlZ1WGpOKYn1LwmJWuKxXXM753l5:uYk0+9uJjE0UnceFhERQKYWmc+7d

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4344 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4344 AcroRd32.exe
4344 AcroRd32.exe
4344 AcroRd32.exe
4344 AcroRd32.exe

pid	process
4344	AcroRd32.exe

pid	process
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe
4344	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4344 wrote to memory of 4508	4344	AcroRd32.exe	RdrCEF.exe
PID 4344 wrote to memory of 4508	4344	AcroRd32.exe	RdrCEF.exe
PID 4344 wrote to memory of 4508	4344	AcroRd32.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 3580	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe
PID 4508 wrote to memory of 2260	4508	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ffef2b5c0775edc043c568261b69b714_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0CE7C5A5EF16ECF6593A4D9D74A74C01 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3580

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8B4E08D6F385047F28BE41EA9F999F30 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8B4E08D6F385047F28BE41EA9F999F30 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2260

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ED5D23634F84A345A09CB34FDA93B0ED --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E74FC81D8AC1DB15B34AEA860AA0163B --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3420

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=886540712D6C0DACCE117AF97D1B2380 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=886540712D6C0DACCE117AF97D1B2380 --renderer-client-id=6 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFE387BCFBDA988A847CBF296738BB6E --mojo-platform-channel-handle=2396 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
b26810e462b4b4e7ac219f477d153f31

SHA1
e0124a47f7f757eed6758afe9fccaf0f222aa020

SHA256
d57defec76136251db9fdb9290dc34066bbb950267e7d31d064ea114eadc9ad5

SHA512
4c838e527590dc1c9dadfc96cd813b3b2b47af5f84a77b6669b3cff5a692401fc85ee48a553c804691e03b9ddb7edbc223eea1dd933003fc29b85191a2529f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
2167f284478205c3234380feb3e831fe

SHA1
99073680e84825558c1f0fab9ea523d82efa3b36

SHA256
eefdc4221306dc726040f1d49eef624e1df936873066a6b421e36f49dc7d035f

SHA512
8708ff02683e91d1bc8ed3cfadcecaecb42cc5283b006924c5176016e183729ea19ce96c55b545d2994dd93fb142cffcc41c8cc22849a2dd6334c5d941e53f88

Download Submit
memory/4344-30-0x000000000B600000-0x000000000B621000-memory.dmp

Filesize
132KB

Download
memory/4344-29-0x000000000B600000-0x000000000B650000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads