87d3e5bb36976f20b7bb52c3e6ec63c1252336aa02a1978e46aa29add3bc5290

Analysis

max time kernel
141s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d52a68027bfbbee846330747bf3a2c5_JaffaCakes118.pdf
Size

39KB
MD5

4d52a68027bfbbee846330747bf3a2c5
SHA1

3176c922467bd31dfb0888af1e1ae484ae463371
SHA256

87d3e5bb36976f20b7bb52c3e6ec63c1252336aa02a1978e46aa29add3bc5290
SHA512

42db2e9f3bfc2b80eab59c255cd5f89333670af054554f18621d99807dbd39a31c49b5f1a9c2b4014cf72592c98e3c2d8dab1a6544c99d086c39a1e18e8a3a02
SSDEEP

768:KgGzpD4pbBmlYi7s+hC/zTJsdwlkiwK/5XR9OY0+RZPxfPsc+jahTvtul:XGFspbl+MXBh+KfnWahTvtul

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2688	2592	AcroRd32.exe	91
PID 2592 wrote to memory of 2688	2592	AcroRd32.exe	91
PID 2592 wrote to memory of 2688	2592	AcroRd32.exe	91
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 5016	2688	RdrCEF.exe	94
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95
PID 2688 wrote to memory of 3892	2688	RdrCEF.exe	95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4d52a68027bfbbee846330747bf3a2c5_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0CD8CB19DE6FECCACBBA6F6D407B59E6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0CD8CB19DE6FECCACBBA6F6D407B59E6 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A8FE785E5B085011E534B27D8FC0BB9 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D3C342CD9D355E087F6B68B9FAAE042B --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2208
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AAB16ABC5BF819D8D6A5DA6DD776B3B3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AAB16ABC5BF819D8D6A5DA6DD776B3B3 --renderer-client-id=5 --mojo-platform-channel-handle=1984 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=389F35201732F0E82624EE9CFAAD07C4 --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1720
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AB2A6D16166834F41BE5DE5C2B4876E --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
2c6569eca7a479b6d3c94e24b9c0d970

SHA1
e8414da11f5c1673588808294530864f5f8127f6

SHA256
da1e992de2348e276b69bc8ade0566e034c92d575ade8b0d62de696cde1703f1

SHA512
ed29a1b9894dbd65a1954972d973ed7d4f8a1f6dbf2ea17dfa5a20114ac8aee745e2d8aa719b87003566cee0a14be1188daaed625d48bf68de4ee5d249f6ebce

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
e7bb2afc667d9358f111ea4433696744

SHA1
9257bd77fb20f8e5d05516974a4ca4f85e8a85d6

SHA256
51e5b89e453ff9e8da9b3d3c7308ddde8acb4f995fe16bb6b9b153ddfee7305a

SHA512
0f8036fc9c3728653ac71d5f93ade0dab32bbdec2a8c24277845c23c049dcd2d605944b5ef7c440f715bd4f93fe13fdfe64b1e3aa4fc0c8a18dfb6fb56678610

Download Submit