a9c22637748ff5e72dc6c7b77fd48d5d7c0a9645ad4faa2667c7fab3c932cacb

General

Target

4c5546029419405e96d7230cea5f6783_JaffaCakes118.pdf
Size

12KB
MD5

4c5546029419405e96d7230cea5f6783
SHA1

6b5bf4df891d0f8c84f7b2de4504d6a7f70ee066
SHA256

a9c22637748ff5e72dc6c7b77fd48d5d7c0a9645ad4faa2667c7fab3c932cacb
SHA512

ecdcedbacfe443fa22303904bdc8796d678e8b737ea25040d456c0c2102bcfda1a26b090a4f957e26472a1dd386a47ef986b50b224d7d9268f6bff9f5b4382b2
SSDEEP

192:WJNIZPH/vewBTsWcz3WU2truhHkDK1EGeqHJBSP2Czs03TaeMtKip:W8PH3bTa3ZLt1EGeqHJUjzsHVx

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1020 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

1020 AcroRd32.exe
1020 AcroRd32.exe
1020 AcroRd32.exe
1020 AcroRd32.exe
1020 AcroRd32.exe

pid	process
1020	AcroRd32.exe

pid	process
1020	AcroRd32.exe
1020	AcroRd32.exe
1020	AcroRd32.exe
1020	AcroRd32.exe
1020	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1020 wrote to memory of 2668	1020	AcroRd32.exe	RdrCEF.exe
PID 1020 wrote to memory of 2668	1020	AcroRd32.exe	RdrCEF.exe
PID 1020 wrote to memory of 2668	1020	AcroRd32.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 736	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe
PID 2668 wrote to memory of 2408	2668	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4c5546029419405e96d7230cea5f6783_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=727597CE26CEDBDF32F4B3D5A5D3924A --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=55051B96063951627629114B8A1BD543 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=55051B96063951627629114B8A1BD543 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A1AA9C07704AFE144A83FE31E2D667CE --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4C910512D593CC32BF1A31FA55D6B56B --mojo-platform-channel-handle=1824 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4168

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ADD66D56A9A1955EACB00D3DEAD21BA5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ADD66D56A9A1955EACB00D3DEAD21BA5 --renderer-client-id=6 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F2FF5234DE676695E97EC9D616C386FE --mojo-platform-channel-handle=1824 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
18df94638a4e9d9035deb09c15e99fd8

SHA1
a897bb093005e79d7fce50949647a84afcef372c

SHA256
99e38a878ea9e942a8be925a54bae6143419651b3057dcd5209f15f6d14c2a6d

SHA512
5abd43605ace21d57bfe28a8df5a02659f12463567cc7b9df8009a7b1aa0c1e44274857486cb6df90292fa6f14c5f102f175e6c7a2b89899136904a634fe547a

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
5fa3f34a8ce42f1180eec6e010aee3a4

SHA1
f578f46f8c92d3e79ad4f80ced9becbe602304f5

SHA256
237a5b5940f8cde02fabdd52cf0a72eb418c6d6947657920300671b23ace6f89

SHA512
2525e43918676cfbf9eea88acbd13cfeee5a408f619267d0fc20a6d57a77c01727e0c53c296f1d09d87d68ec16f2e2c0f62829c78c58a2cd825ae6ca3947836e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads