08e053fe0a097da3515c67285a29eae89677dcd38b127a07566d4d32e357d4a3

General

Target

001add068eff11b8203d14a7c95f14cd_JaffaCakes118.pdf
Size

51KB
MD5

001add068eff11b8203d14a7c95f14cd
SHA1

4f922889fa2bbb3731ce0f7ab60196a499d1e413
SHA256

08e053fe0a097da3515c67285a29eae89677dcd38b127a07566d4d32e357d4a3
SHA512

5c7faf7d742db02242c4e6ab9aabeca24b8da97e3f5bccee066895b61565afd6a8ce063e950027bfbbc39d5c20a82c35a11c449767bb60040f5cd482ffd14cb1
SSDEEP

1536:OGF9D54KqYosBl2jBvbiBoW1+g5FH51zeKE:3F9d4SnPmiBl951zg

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2920 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2920 AcroRd32.exe
2920 AcroRd32.exe
2920 AcroRd32.exe
2920 AcroRd32.exe

pid	process
2920	AcroRd32.exe

pid	process
2920	AcroRd32.exe
2920	AcroRd32.exe
2920	AcroRd32.exe
2920	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2920 wrote to memory of 3712	2920	AcroRd32.exe	RdrCEF.exe
PID 2920 wrote to memory of 3712	2920	AcroRd32.exe	RdrCEF.exe
PID 2920 wrote to memory of 3712	2920	AcroRd32.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 3932	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe
PID 3712 wrote to memory of 2072	3712	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\001add068eff11b8203d14a7c95f14cd_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6F3ED8BBBBFF645FCA03E5AE6F6EB2A9 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3932
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=12CABB129074417428CDF5FB4AB308EC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=12CABB129074417428CDF5FB4AB308EC --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3BBFBA0926E2DAEAC6AD1CB43D3A3969 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3184
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9CBC1193F7C924349C1D1823808A9140 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3416
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0A463244F0751BFF9631F44B2603C93E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0A463244F0751BFF9631F44B2603C93E --renderer-client-id=6 --mojo-platform-channel-handle=2416 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1036
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A637AAB09DED514939F59B2462C6750 --mojo-platform-channel-handle=2856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
7b6ef9302ad4324cba295ea96cf33a2d

SHA1
4fe63637f01996a78ba2540b6847fcc759face0e

SHA256
aa62a805705d1ec59ae78b59cd7817bd1f2e04155b3771e95511ba412523f8da

SHA512
1cd5cc3351a5eb8f38dc4b8eeff2cb760ef16c0ece63c25b8b297e3cf0f7e0039e0719eead93f9f21d3d7fffd513a9dfd9f2ed6c2a228a2028af017a366c8713

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
01160fc03108179a7303ca29e7c0727d

SHA1
7b531d227a610985cb8e198403ab5593c1174ccf

SHA256
d34d3d3a694f0fc94150e80c46118ab3717cd5f348bb15ba8a280cc2303d2692

SHA512
6884d14dafb03141440ece130a894ed0b9a3dace5ed835520a52d570ebe8b0f68a0cf503f2b8d94c018008107f573d3954e08ba5c25a1003aa3e09ee8e62fdae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads