Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 10:05
Behavioral task
behavioral1
Sample
0086b8592be84c9dc73fa0d974138124_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0086b8592be84c9dc73fa0d974138124_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
0086b8592be84c9dc73fa0d974138124_JaffaCakes118.pdf
-
Size
44KB
-
MD5
0086b8592be84c9dc73fa0d974138124
-
SHA1
7ed3165522785edd4ac13460182bd6698afab862
-
SHA256
411def0e0d4d9943b386ae19d6fb4919b83107850cf61e5f92f85f359393821e
-
SHA512
2d23358de807f914ffecd044e4ae4d5b0d1e0e41a52fe9ccde21b1eb93e79abb3ce3993db4f6efd5db8b6f41bb9b2175fdff6619aa29903b180ceb72693d2831
-
SSDEEP
768:zF0LcR/0bn/J1k9BK8qoqthco5gFzU+8Xd0N1vXPR0cn9OUT4nwAUIKumdPiWSEB:zOoR/0DR1k9BK8qoqthco5gFzU+8XeNl
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1176 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 1176 AcroRd32.exe 1176 AcroRd32.exe 1176 AcroRd32.exe 1176 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1176 wrote to memory of 1872 1176 AcroRd32.exe RdrCEF.exe PID 1176 wrote to memory of 1872 1176 AcroRd32.exe RdrCEF.exe PID 1176 wrote to memory of 1872 1176 AcroRd32.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 836 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe PID 1872 wrote to memory of 3436 1872 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0086b8592be84c9dc73fa0d974138124_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D76D40BC23F1DFEF4FD499FB8199904F --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F17EF6D9C2705DF548B50C3E4222641B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F17EF6D9C2705DF548B50C3E4222641B --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1F876226B7AD5C167135771B7A79812 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0A31ABCC415CE3FE83D06D78F262E8C9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0A31ABCC415CE3FE83D06D78F262E8C9 --renderer-client-id=5 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B2E4AD0BDA21BE04B515483FB93542FB --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7DAC6D5B4EE1C2B5F76D91DF3100D95E --mojo-platform-channel-handle=2768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD551872d2de7255ad9a9ec4f948701bb88
SHA15de180b86263f1fbfdaaa8fb4dfb0789fa30dc1e
SHA2564bde44c5cae7cbf594d7142480e670411a1b2488b2d0ddad601962818e7c2770
SHA512a154255c94ff31e6d8f2211465ff6ccf24ba6f8a8e5de32e9d612a097f937650cdef9246d7e09390596a7a0c4773d2044302896f06461ee487b3db6f9fddf529
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD511c3bd1fd61fd99f3da6702b75beaa12
SHA1eb60d4382c3b38a06fb17fad9dc2a86328bc201d
SHA256421a29da53fbf28318849a95e0ee09e7b3020b7a7feff69b61ee08fad61b2968
SHA5129e917640029f4dc6c31d6f05a5c17ae172180fda866b8d3bfa7adee6ffb46e041a474442c645c1ebcf0307aea533a67082ab03248f89972376981bad8342c272
-
memory/1176-30-0x0000000009DB0000-0x0000000009DD1000-memory.dmpFilesize
132KB