6ea558f01fa52676502d4a5a81515c8ba716d8a5a0824e24e5009732d8cbf061

Analysis

max time kernel
94s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 07:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38f0ec23a4f9b47988f3392196112229_JaffaCakes118.pdf
Size

36KB
MD5

38f0ec23a4f9b47988f3392196112229
SHA1

7427066f86e408f00ff32da8380ddaec050ea098
SHA256

6ea558f01fa52676502d4a5a81515c8ba716d8a5a0824e24e5009732d8cbf061
SHA512

8049e27fd40ea69aa83360a0ae8af78cdea585ef99aaaaee5069d76767d414918184aec15523b45bd1576494946951c4927e0f1e4526ba3fe045cdf2a8af9b09
SSDEEP

768:3gGzpDadrRavwRYynCVBlMCXiMD4L4DM55e70BzcNBp7rPsfq2SVpmB:QGFudrRKTDq07yzyB9of+VpmB

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3984	AcroRd32.exe
3984	AcroRd32.exe
3984	AcroRd32.exe
3984	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1140	3984	AcroRd32.exe	88
PID 3984 wrote to memory of 1140	3984	AcroRd32.exe	88
PID 3984 wrote to memory of 1140	3984	AcroRd32.exe	88
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 3636	1140	RdrCEF.exe	89
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90
PID 1140 wrote to memory of 4928	1140	RdrCEF.exe	90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\38f0ec23a4f9b47988f3392196112229_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C655D0E3EE27EB502CDB9E51C6CE0B8E --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3636
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=55768B89AA2E603BBB9D0F8F680A5C22 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=55768B89AA2E603BBB9D0F8F680A5C22 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0AD12A02702E72D24732991BDBC51AAC --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4592
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B785342EAE29D516D93982A3E723241C --mojo-platform-channel-handle=2416 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3352
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D01D4AF19C4ED7FA3355B612D36C7388 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D01D4AF19C4ED7FA3355B612D36C7388 --renderer-client-id=6 --mojo-platform-channel-handle=1896 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FCE03C7D719784796FEB34E626DB84A2 --mojo-platform-channel-handle=2700 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
09a85cdeb4d34024bdc76d9d706c8766

SHA1
ac7a796d9ad9d814bec0e676a14ec52edf2266dc

SHA256
0581c6cdbed52d9aa3ae9b1b3b623b65b3fc37c393e22065872a6ba7cd35ff19

SHA512
34e5e6a0720f917ba359e0d08a8191768efd74d0d578cc4453be0fe534ab5e672595aa92a657b7ad031b985b6cc4e5d8798e7da665c8fac67792f7fc022463f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
7b7d5174aed2fbb6836b6cb139dd6572

SHA1
81e7ce89bdad5718bbea3d78b640e83f59a29b82

SHA256
5ff1d918901f1d8a87e080cbcfd05e58e52a5f50bb188f70afc9d7cb92991408

SHA512
f2ca2431373020d3990534603187433dba64ad4d2cdc5370b4900ca279464b462c2871c6ad4479d75317d73b99181f6eea95888e67cc0416f2878e588e189856

Download Submit