c2d0f68e2067e07deb6ce06f380ea023893e1b2feefab7c1366a939fc951c899

Analysis

max time kernel
136s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6b22920649f14e60fd19bb860ff722_JaffaCakes118.pdf
Size

36KB
MD5

4f6b22920649f14e60fd19bb860ff722
SHA1

a598b32b991c70a3f5ccaab038d4035e9f6641b3
SHA256

c2d0f68e2067e07deb6ce06f380ea023893e1b2feefab7c1366a939fc951c899
SHA512

8f7dc0fa9b674bdf8ff6ff60fb9a55b373bd9a8c057ac0cc26cc9475ec42b0270945f413a7de37f8060bd006a953e734f17a03ff36f12028e06091ad9410e726
SSDEEP

768:BgGzpDwer8BVnMsYFtSaJrGl1j9hJx6F3hK/t9PC0KVta4Gst0xq6kEI:yGFMerPkt6bK/jPCNa4GstP2I

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4068	AcroRd32.exe
4068	AcroRd32.exe
4068	AcroRd32.exe
4068	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2948	4068	AcroRd32.exe	86
PID 4068 wrote to memory of 2948	4068	AcroRd32.exe	86
PID 4068 wrote to memory of 2948	4068	AcroRd32.exe	86
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4348	2948	RdrCEF.exe	87
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88
PID 2948 wrote to memory of 4304	2948	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4f6b22920649f14e60fd19bb860ff722_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3872401AA551E3CCAC324D325893D624 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4348
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9959BC95BFBB7884E7282E42F457F721 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9959BC95BFBB7884E7282E42F457F721 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E4D13F1431EA30BB91D5F31B0AE24A14 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5004
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E95A21EA94655AF0C91C9B5EBD0DCD9 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4732
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=607CF211D12DA645D253A27A01A616B0 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3868
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D895F78C07DD53D8B4CD597D7E033949 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D895F78C07DD53D8B4CD597D7E033949 --renderer-client-id=7 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a1d918b40132f26385b4bdc43def1036

SHA1
03fd5cb88b47d430fdad868decc570a666c857bb

SHA256
7213bab283430d73400c866e001401f9b087a14260de8b479ef872e762f49c45

SHA512
5818ed1b18cfb9f9e2eb6191f4c752ef98965d67cca6cf58668d469cf645b271b77988c3fad8dbf992e4648532a9e836c886d2a4048841cf1724b576c9a5c278

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
df4522010d1046e409fe741af5653740

SHA1
01ddc7030b8f774a639048d63cb169d5e4b1a6dc

SHA256
c8645c3bae2f18c856dcd7d13b8fd83d17356b0655cb5991e23cbe310b5bd10d

SHA512
d1b408cf26417e5e93b79882bdd37d6b68fdcdef860491aded9a1c87c76e02ba0532dada2ed1a6253b95ae7d300436a59884c68e508c6dd53730397a29950f1e

Download Submit