99de3cfba02210ca5eb1762f7e6c95659335fab0f4219a0eb6b2eab46cfd1edf

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26ecba16bb1c7353a67a83c276a8ab8a_JaffaCakes118.pdf
Size

81KB
MD5

26ecba16bb1c7353a67a83c276a8ab8a
SHA1

d778b2fc89ccc656393b8d4c540069e180e7ca87
SHA256

99de3cfba02210ca5eb1762f7e6c95659335fab0f4219a0eb6b2eab46cfd1edf
SHA512

ea0b1ef5842115a026f9460b67d1821fd0323eeced7d87fd7ca9d07709c723ad1240fca35c407a72bd45fab2297b4cc99a967c67994e9ecfe8467f9a43f13908
SSDEEP

1536:fGFTp8I7koNHMF5v716c40Z/opMZmCp8TEgZmmiLsbnHW/SxXBy:OFTpFLNALGMACpoEgZmjLsbn224

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4888	AcroRd32.exe
4888	AcroRd32.exe
4888	AcroRd32.exe
4888	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 392	4888	AcroRd32.exe	84
PID 4888 wrote to memory of 392	4888	AcroRd32.exe	84
PID 4888 wrote to memory of 392	4888	AcroRd32.exe	84
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 1792	392	RdrCEF.exe	85
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86
PID 392 wrote to memory of 3596	392	RdrCEF.exe	86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\26ecba16bb1c7353a67a83c276a8ab8a_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F056408F3C477C6513694469268A5C1C --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1792
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8FDD40826B527B7E58570EF3E562B574 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8FDD40826B527B7E58570EF3E562B574 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B6A98DEAABEFCEC73546B0A0D267BF17 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5080
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4B0DCAE5691F4280B7DB79F85ABB80E9 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2468
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F755322473858399995D2B366E4F8058 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1404
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=645D255B82CA71D73FF84B612BDD2D82 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=645D255B82CA71D73FF84B612BDD2D82 --renderer-client-id=7 --mojo-platform-channel-handle=2516 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
cddc5dfcc08de740a069ad9bfa88c33e

SHA1
d0f2ee63b39239453901ce6a54a6cc1522c58f1c

SHA256
3468033d54e56075d7682d344709f6b473d580f3a9aba71772a7437b057c39d7

SHA512
ea0208dfbbdb8a53c3ca8898128c5cd426aca35994ef7496560d8903fa1e94f7a2292906e2afb0eaacec2140587e6ed6e6e91ce272c21389633a5174bb97b85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
290c04a96de5f073376f8ed00adf5820

SHA1
2c7088ba3d1a7a01a03725aba00b7ceb262a5e07

SHA256
fd56a12d3b9f25180e9b46b37f1d4bed72cf96895425fb7facc9859e70a8923d

SHA512
d2670c80e85f7e123bd8e982f6402b44b42d7225b492b0e398a5656cf46fc1cf2411b6c72ff8633cc574cc5ddb287fa95d112dfebc6beb7a5fea6abac2e8f7ea

Download Submit