44d329b824c4194162961c903dadd071cb1c41d1146019af97a18d0c2e50e4ed

Analysis

max time kernel
94s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b5daf6ab92241303bf1b40b4bdb3b08_JaffaCakes118.pdf
Size

38KB
MD5

2b5daf6ab92241303bf1b40b4bdb3b08
SHA1

738c90e86acba56fa6aee5690d92d0c981fdf084
SHA256

44d329b824c4194162961c903dadd071cb1c41d1146019af97a18d0c2e50e4ed
SHA512

6d1c079947df1d1b9113100cb7c5e740dd2fe634eb043982ae1225ad7a57fb4b080af0de7c0b4f8e34828a6767448b556143af2c20dea07f89a1309b0b28c26b
SSDEEP

768:z1hZy1sGaSKL71jysQ5KDeQtH0zjT7/klolDIhhz9yBRBXfPjBHkOyp361H9IPZL:z1XAsS01jaTK0HT7/klolDIhhz9yBRB2

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1376	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1376	AcroRd32.exe
1376	AcroRd32.exe
1376	AcroRd32.exe
1376	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1648	1376	AcroRd32.exe	87
PID 1376 wrote to memory of 1648	1376	AcroRd32.exe	87
PID 1376 wrote to memory of 1648	1376	AcroRd32.exe	87
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 2372	1648	RdrCEF.exe	88
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89
PID 1648 wrote to memory of 3156	1648	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2b5daf6ab92241303bf1b40b4bdb3b08_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2F9049B83F03B3A8C0CD6FC10BF42F8A --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2372
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=92B35FD33C1708378E0B5CC2811EBF6C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=92B35FD33C1708378E0B5CC2811EBF6C --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3156
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3B85F766891B6ECFE08A4DA54659FA3D --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3304
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C537FFBAA32E930D3312DA99E6C47A09 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1104
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=03648174FB0521BA114F3360BE6B91B9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=03648174FB0521BA114F3360BE6B91B9 --renderer-client-id=6 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7C51AE9B5EA375DE43BFEFF35CB06794 --mojo-platform-channel-handle=2776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ae9bfd32c0037fea927added55c1581d

SHA1
21e00b00e4ef86d87645107ee0385f777c55cf67

SHA256
a0e7f02b08eac351a85ad9133044e2e8ddc070ca221936ce2d942937afab17e7

SHA512
bde6bdc2ef18a353bcc1bb0bc8962ab4c879a999902ec88d511b32ed78ddad7114f6f1936f69059095d1a94bf298729cca6a470555794505744906a06a7940af

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
263cbe0b4920e20e90c008198199827f

SHA1
8b864346f73bdbfffe8399ba58049e1a1f291f17

SHA256
93609400e5682cc7754f1a0f008f7192c9ab17b9b91ebc4b51756f576061e3cb

SHA512
077403bf67124e48ef245fb7680764d853e4dee5ec78db615414e29bd72682d11d23b59bbdfc3c4539d39244fbd9937eaafe28dbf737ff27049cad500759cd77

Download Submit