45c2c07a3b00a7dbc413539b2c6eb434ed421b4a35f3d74204a5a8ac9ea9400e

Analysis

max time kernel
141s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

281bd0fe467e5b7d8866c2c982d8af10_JaffaCakes118.pdf
Size

39KB
MD5

281bd0fe467e5b7d8866c2c982d8af10
SHA1

ff222fbd386c58c5c4a490210acbe51e1b8d9487
SHA256

45c2c07a3b00a7dbc413539b2c6eb434ed421b4a35f3d74204a5a8ac9ea9400e
SHA512

8bb01cb92a54587d143361cd9d11b4f72d6de8c4a259d56378604a3348eec17662623bb916988ee2aa9b24a95c6e75cf2c29919b8059e78467c177d8af180075
SSDEEP

768:PXuMZmwgCLWar6E7i6q/9CpmD0SnM4GlsZZqcVON5f3ij5qeSd:PXFZmGWScQ5OvGyZPO7UqeSd

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3184	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3184	AcroRd32.exe
3184	AcroRd32.exe
3184	AcroRd32.exe
3184	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 2044	3184	AcroRd32.exe	91
PID 3184 wrote to memory of 2044	3184	AcroRd32.exe	91
PID 3184 wrote to memory of 2044	3184	AcroRd32.exe	91
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 5372	2044	RdrCEF.exe	92
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93
PID 2044 wrote to memory of 2820	2044	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\281bd0fe467e5b7d8866c2c982d8af10_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0C6A6B48FA1FE118818AC58415635468 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5372
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C61A78CC77C2E4A127B54D192C392151 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C61A78CC77C2E4A127B54D192C392151 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=46541676724815E5679F0D18EA9D3E91 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5108
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=99ECFAAE776061EE8271A7BE386EA7D1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=99ECFAAE776061EE8271A7BE386EA7D1 --renderer-client-id=5 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=628617EE7CFE22F56698B7A66917A603 --mojo-platform-channel-handle=2464 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B0424EA30EF36E5E872B38DEB2F6C951 --mojo-platform-channel-handle=2368 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
736d6b8ecc7ef58ad312b32e61c59043

SHA1
c572e3c06969d1f0c7c1c0ea2ba3d8e6a45503a6

SHA256
6f60da8a83d920c28ee2c1bc0284e8691f39337d0c647d04deeed4a749dd1d34

SHA512
11ee273f74bc86ec960d0451f2f5ce8c05d42ce5abc3c1ad5454b8f12296f22171d356e93455400a7a390152f75c7e739956e8e66a85fd7dbcdf48930fdce544

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
984260dc4734260d544a4bdc86f4ff62

SHA1
ad202dfdf2313057bd9b51e6a1231362b9fb91d9

SHA256
aee1c3837c814c35ac5f590f44820f62a23e7b7eb57ea1fd0b8aa5e9192a0435

SHA512
7774875e476e9e56ebd41b77d55fee2e78f75a26c58b03d7c699d562963479001119c579eb03e904e5757e072840e50d9172de9a290f0485d8b8a655c47db721

Download Submit