4ae2f5fd55a5b25e8b588776994e643774e8b0dcaf9cadcb7e278f953e0c4c77

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

451321bba98db8fd5b24a8e0280700af_JaffaCakes118.pdf
Size

57KB
MD5

451321bba98db8fd5b24a8e0280700af
SHA1

d29fce7783815b18a1c88199cf7f0a62b67583b0
SHA256

4ae2f5fd55a5b25e8b588776994e643774e8b0dcaf9cadcb7e278f953e0c4c77
SHA512

cad51648acd8c4909d404ab0952c5ece69884283c0ad0050461e9878a0b1b431c7735fb34e6e77e1081a7e9f84fe4307780a08e0ff6b21b7e92dbb7689ba1276
SSDEEP

768:KgGzpDcR8i3GpxYQVJVQ5NLWh7ASE3m3EYq5grvJAZOGf5A+hjjjUC0zltE7L/IW:XGF4OjkfmeAl7ltDSOVVKTQM6i47u

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4064	AcroRd32.exe
4064	AcroRd32.exe
4064	AcroRd32.exe
4064	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2544	4064	AcroRd32.exe	90
PID 4064 wrote to memory of 2544	4064	AcroRd32.exe	90
PID 4064 wrote to memory of 2544	4064	AcroRd32.exe	90
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 3940	2544	RdrCEF.exe	91
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92
PID 2544 wrote to memory of 1404	2544	RdrCEF.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\451321bba98db8fd5b24a8e0280700af_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6FBD7F9FEB956250D452F683F5F9F03F --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7ACFBBA8D2C9C743ED4CADCEEFE3DA72 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7ACFBBA8D2C9C743ED4CADCEEFE3DA72 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=356B3C401331C6C8AA4613E8E841CD6D --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4040
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C5DB1F0249A4C307314ED986D033008 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2984
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6FF9D52D3EFE6BF49CAE8ED8D54372A4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6FF9D52D3EFE6BF49CAE8ED8D54372A4 --renderer-client-id=6 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D67A55B544B851223CB0CD416598E25 --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
614d1adbeaceefb0e6d8829170a29f07

SHA1
525fba472e9ad1373c2c67bb6842e32a24ba30bf

SHA256
c2aa27ec92db090ee869bb3b5e065a9bf6b0362f21d2aa9dba43b592716059ee

SHA512
d27de937e2ec483757ce6f82eebc28089b50ce57366c57614d08e9782214c0ccf009ac60555fa91018a74ce226b25976f4fb2ca4f7970ce5e05ff4b498fb1a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
10399855dc4525a4104bef29cdd18c7a

SHA1
fd8d72431f71f6b4312ea744b976e068f0ef8033

SHA256
6395589049ace5290a562b86e5fc51c2768431311ab23cc99d0d65d1047d81e4

SHA512
bf81f44da6cd39b899395b3f14d4b3c01d8a748c2988945fb4e14d1966a54c4c69b86108acff8cdf35639c7fb6c15e6de69e4e434f4953949a22c22ee0a118c1

Download Submit