8bbf5197be5d674419f1d6190a5202ff079bb305c37a57a6b85934d13f116d0e

General

Target

54ce852cfed513185f2a2286e897b6b6_JaffaCakes118.pdf
Size

8KB
MD5

54ce852cfed513185f2a2286e897b6b6
SHA1

ed3811dde80df65a204ea7310cb29584ac8214d8
SHA256

8bbf5197be5d674419f1d6190a5202ff079bb305c37a57a6b85934d13f116d0e
SHA512

d111dc59bb01ea9724b2e4a2a087d48e6e5d639708838ee6efce81c9a71a39d5ea69f89fb0bbcfc397e49544c847075187d2211f4641ea4dc3866a2ed9466e27
SSDEEP

192:hrf2tPFDrbYjN37WbjHuFFGYk6DohILbyd0/z5D:tf2Trb237De6/L+i

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

5064 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

5064 AcroRd32.exe
5064 AcroRd32.exe
5064 AcroRd32.exe
5064 AcroRd32.exe
5064 AcroRd32.exe

pid	process
5064	AcroRd32.exe

pid	process
5064	AcroRd32.exe
5064	AcroRd32.exe
5064	AcroRd32.exe
5064	AcroRd32.exe
5064	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 5064 wrote to memory of 1728	5064	AcroRd32.exe	RdrCEF.exe
PID 5064 wrote to memory of 1728	5064	AcroRd32.exe	RdrCEF.exe
PID 5064 wrote to memory of 1728	5064	AcroRd32.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 4272	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe
PID 1728 wrote to memory of 1460	1728	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\54ce852cfed513185f2a2286e897b6b6_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F56EB703EE3C7595756F40F5522F3D7B --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4272

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0388673A9791ADBE56B0C3140FC21DAC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0388673A9791ADBE56B0C3140FC21DAC --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E84E3CAB743573D0ED57C8F346DCD1FE --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2732

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AE3CB9AE12F316B5A980465E65C2778A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AE3CB9AE12F316B5A980465E65C2778A --renderer-client-id=5 --mojo-platform-channel-handle=2432 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=08D060E3537460E70C1A2E60C6FF3C8F --mojo-platform-channel-handle=2528 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3496

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6CA372B2C21055F32369DE2289D9A3ED --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
ef6b4a4ed710eb812ea087645679f399

SHA1
16cb1457db27d27c92a255aeebbc810aff133d0e

SHA256
7d78d80abfeda4953f2f06765444ed4c0f6b24bfc613f84038f504e5675ce8fc

SHA512
7f19088521f9b9eae0e8786c2f407121c3fc82714590004a81dd909cc187b38ad0d4d14dd1347d35b56f76a94254a4e8f701b65695b0cf28e2d530cf99a2daf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
fb7eb9e6a48be7261e30275b2616c3dc

SHA1
ebc3797d75e9e6c6307fd3fa5a81f85759b1ebd3

SHA256
8fae54a37f97c36fdd82d3e533c03c588308c5e3a8629ac10f21a79a453f69f7

SHA512
82b7571286e569ef29719440c526d7ddb32406ca436d96c3566b3ccd4511f6977e4329130bbd56427d391a04a56dd4bbb34b8b5fe19647ce8debdb1d7764f272

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads