c8ca2334ad52621e3e00694dfbeae2c4eecc5c23515e24e64610fae6efb94134

General

Target

5e02e58dd0e0cf9ecfb9cc30627f4410_JaffaCakes118.pdf
Size

8KB
MD5

5e02e58dd0e0cf9ecfb9cc30627f4410
SHA1

b617d5837e0086a5bf6eae498353aa16d5bcbd04
SHA256

c8ca2334ad52621e3e00694dfbeae2c4eecc5c23515e24e64610fae6efb94134
SHA512

6e7d64433ab507f2015cf42b6f2e42d67acd4c45a7b4e711aed26241ee80fa32db2ce843b964ccb5ea9e448d86c1890813c3479133c123b21bcc241db2acfad6
SSDEEP

192:HgMNUIeEP1CDxCbWwYJdzTSnqJOuXstvjIgfBYUjbc:AMNUnEPkDxUWwYzKjyQjIgfBYUs

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

5064 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

5064 AcroRd32.exe
5064 AcroRd32.exe
5064 AcroRd32.exe
5064 AcroRd32.exe
5064 AcroRd32.exe

pid	process
5064	AcroRd32.exe

pid	process
5064	AcroRd32.exe
5064	AcroRd32.exe
5064	AcroRd32.exe
5064	AcroRd32.exe
5064	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 5064 wrote to memory of 64	5064	AcroRd32.exe	RdrCEF.exe
PID 5064 wrote to memory of 64	5064	AcroRd32.exe	RdrCEF.exe
PID 5064 wrote to memory of 64	5064	AcroRd32.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 2780	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe
PID 64 wrote to memory of 3240	64	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5e02e58dd0e0cf9ecfb9cc30627f4410_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:64

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EB0C87A20233E01D8AD4D8A048570FD2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2780

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9F4F94E83E21E82CCC0362EC8FC97626 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9F4F94E83E21E82CCC0362EC8FC97626 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3240

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=82FC2A6647834EC25117DD3E727D5C51 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3392

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=54F0D3B29DAEBC982E0C5C0D4F18E460 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=54F0D3B29DAEBC982E0C5C0D4F18E460 --renderer-client-id=5 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EFBF2253CE72604731D19AD5C1341824 --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1916

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9C468D00207955FC37783EF3935B985D --mojo-platform-channel-handle=2388 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
891eda3dcc5eedb43aac5dcbfb2181dd

SHA1
e033cea5db978dd6baf7b2d5e78c8dcb5d43fb1a

SHA256
0a6269f6d747b304afcec9d55662e6281333f943b7955d4cecf9e7ff53619391

SHA512
51bad80e744e0a65573e813cbdcd0ea44aaea81caf434c438022887076c52efb8a03c24cd6d5fca3be79fc83a2ed0ce7b508806a2b5cdf203b5086085d95a1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
4322f47e74b2a8c411b3d2ed3f9a606a

SHA1
eaf6e9ea34e4209cef9cb6bd8daaa50e5855d722

SHA256
77f0ecd7f332a1c5fc520be62e0986fc235673f25bc70e764241f7897b815f3b

SHA512
b556440a13b539365feec2c37b06ec1deb232328bc25020b4dacb8dc89cbbe1e52c1116474376d7ca86ca2136068095e4ea354fc8d5ba46d617edaeaba8a259b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads