03029998290b9d238fdd45c9ac1b2999fa1fcc9f7e45b81106e99029831ea73e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00108d348891f0f114fb71e246c617f7_JaffaCakes118.pdf
Size

187KB
MD5

00108d348891f0f114fb71e246c617f7
SHA1

53c09298ec612ae1ef20d1327aa1bea1e33c03af
SHA256

03029998290b9d238fdd45c9ac1b2999fa1fcc9f7e45b81106e99029831ea73e
SHA512

ae8e0bd5c89e3aa5eb969c2b274d4a9b1f7db8064f6f37b1a8101269db855fe29c611bb76ab077b0ec3a75e86613ef56e478e98788bf1e9f053b8acb55c4b437
SSDEEP

3072:L2irbxzGAFYDMxud7fKg3dXVmbOn5uk6KjnnQCx/FmyQR0mSY6GEsSm:L2MKlWQ7Sg3d4bOJQCZFKRR

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4636	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4636	AcroRd32.exe
4636	AcroRd32.exe
4636	AcroRd32.exe
4636	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4732	4636	AcroRd32.exe	91
PID 4636 wrote to memory of 4732	4636	AcroRd32.exe	91
PID 4636 wrote to memory of 4732	4636	AcroRd32.exe	91
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 3600	4732	RdrCEF.exe	92
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93
PID 4732 wrote to memory of 2424	4732	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\00108d348891f0f114fb71e246c617f7_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=906599A3D62EEE15956405020786E4F2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3600
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E8E6C11D7923667D9476DDD2C09DB331 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E8E6C11D7923667D9476DDD2C09DB331 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52B0C3A4CD808DBA262090C8C28BDAB6 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:936
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D476F3D1624C7626BC680ADC5F625137 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2628
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=645C411292DA57BFEA4958B6C01C53DE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=645C411292DA57BFEA4958B6C01C53DE --renderer-client-id=6 --mojo-platform-channel-handle=1952 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E9731FE440F8353AC751454BF74EB210 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
616a9d64af54983880c1061df389f3b8

SHA1
9d210f5e84949634fb0ca8c450aa8f1da2cb5b34

SHA256
02061932d114434a0b87d2d8bab3f66a0148941d86ee0fa59f8b566d0850837b

SHA512
8c0dae3b8e620693f1320c597c4a1951bcab91b4cf1648e111d3bbbc8309a1738c8c97978d204141a3d51f536cc5bd9e30b5aef7ef304dde10ad88bc6d535c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
8a6a61f2bd225b39f061e285ac592797

SHA1
86f7c5c9a08271cc7afd26d74ea92abc9e1e45b1

SHA256
179ef454647b424079fe60cd0a9ed1cf355b38bc0a3d6a26c1dbf99e9516737f

SHA512
509a69a72079d3560ff9328ca28aed2eda89a0435ad6b1ae32573f9a19f3753dd8098181afe6ec9a96ae2daf1f0d2a99b6a2d1d9829624a8e8df020e99c37d06

Download Submit
memory/4636-29-0x000000000A6C0000-0x000000000A710000-memory.dmp

Filesize
320KB

Download
memory/4636-31-0x000000000A6C0000-0x000000000A6E1000-memory.dmp

Filesize
132KB

Download