f4daf69f45e3f8d33966134f1d80710604b49689d82709bcd2997855c7b2f9b6

General

Target

007570254ff1df3c1774278cbcfe6024_JaffaCakes118.pdf
Size

27KB
MD5

007570254ff1df3c1774278cbcfe6024
SHA1

2de1016f4649a482b76c828047d44720e712a894
SHA256

f4daf69f45e3f8d33966134f1d80710604b49689d82709bcd2997855c7b2f9b6
SHA512

8abb88791cd23a093bae57fa83c06bfb58df4823b3a7b2bbd886b08e08fbdd93e174301fea02c61c5991881c8ff9615d2d9382b73a456750cca9f0359542622a
SSDEEP

384:u/QON8MUG6Qgw0JZCTzz02YFnarXv6sa5j9nFCOtE4zCe40ybtmqkpk22u5KuZDA:uXuMZmwgCLWarwxgOm4vu8Z5RUX+vTU

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3964 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3964 AcroRd32.exe
3964 AcroRd32.exe
3964 AcroRd32.exe
3964 AcroRd32.exe

pid	process
3964	AcroRd32.exe

pid	process
3964	AcroRd32.exe
3964	AcroRd32.exe
3964	AcroRd32.exe
3964	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3964 wrote to memory of 2428	3964	AcroRd32.exe	RdrCEF.exe
PID 3964 wrote to memory of 2428	3964	AcroRd32.exe	RdrCEF.exe
PID 3964 wrote to memory of 2428	3964	AcroRd32.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 2780	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe
PID 2428 wrote to memory of 3480	2428	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\007570254ff1df3c1774278cbcfe6024_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=12C99D7BE27DE3328175484AA137D665 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2780

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D399C599107AAFDB3E88257776D4EAD9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D399C599107AAFDB3E88257776D4EAD9 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3480

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A045EBBD1EB3EFC7B31C9C478D9DC486 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0274E50C37DEDE03C3FE2371270E3E04 --mojo-platform-channel-handle=2424 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2292

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=140AA1C10B66BEC5FA7E11D45D689744 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=140AA1C10B66BEC5FA7E11D45D689744 --renderer-client-id=6 --mojo-platform-channel-handle=2368 --allow-no-sandbox-job /prefetch:1
3⤵
PID:388

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CB3877775B19977D4E06719E7A566C24 --mojo-platform-channel-handle=2704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
fe834da1fb28262768df8bd4d3ebbe2e

SHA1
e0ea863a16990f751801da2da5428e1e059b98a6

SHA256
d41b6589f22e830b0fd82bd1597145d3603cb3e040d292c3d70f65e25e3acf67

SHA512
8531bd771877fb4c3324ec84a7a077a22f3c1767274e08ebaea0c888f7c573a2e0873f809999a123ec3ff60f825268f6566ab397d474336ef64c3eff657af52c

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
591c64fa35aaf01a1ad807169d305c63

SHA1
57b8d915c62d6e4a2bb0b9901be5afad9e76b2af

SHA256
14d228487a628cf9e229d60817c2ca80f600be5f2971cffa3e6137f56c7d13e4

SHA512
7a72294af719dd39d18cdf6b8536921fb7e46e6a4848619ec3ec36a9142da4ddc73dfc6bf72ff4d7f8d76e5b0f69df01c5240d1fe5f2ea27cf0a14c5446e0f9e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads