b2c9e6e451f6b28d83f6d847b8537db69307b4c76345c6dc3c0690a4838370fc

Analysis

max time kernel
139s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

61ff24ee1f3fb10d84bd56c48d7e75d0_JaffaCakes118.pdf
Size

44KB
MD5

61ff24ee1f3fb10d84bd56c48d7e75d0
SHA1

61bc0c81bd68ad5f368f9eba8fbd791dc9d47a86
SHA256

b2c9e6e451f6b28d83f6d847b8537db69307b4c76345c6dc3c0690a4838370fc
SHA512

cf9a1cd70b2fc50146841c8937cf23efe0b059eafc757eac23f5e88f7525f38e63eb0f4fb29d4cbe6946ad8a4b95369476c992251b4d9613f67e015e2b023eaf
SSDEEP

768:cfgGzpDNprPHap4yvZqWfCSfqIV3ObI7+5gQB07Fmat+o6OI+vMXSVTED0nJVt:dGFZpYn7+CQMFUyI0MbD0nJVt

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2024	AcroRd32.exe
2024	AcroRd32.exe
2024	AcroRd32.exe
2024	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 940	2024	AcroRd32.exe	92
PID 2024 wrote to memory of 940	2024	AcroRd32.exe	92
PID 2024 wrote to memory of 940	2024	AcroRd32.exe	92
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4520	940	RdrCEF.exe	93
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94
PID 940 wrote to memory of 4116	940	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\61ff24ee1f3fb10d84bd56c48d7e75d0_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EAD550EA6998630D92B96F180E07AA86 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4520
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=77DB755CDB6D533A023AE43833EA3DB4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=77DB755CDB6D533A023AE43833EA3DB4 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8EE7A4ECBF2B5DEC2B9DFA87DE50B807 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2696
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2E034DE7E4A486113904CA449923F966 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4660
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0C5A1A42772FD12E5CA559D576F222F3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0C5A1A42772FD12E5CA559D576F222F3 --renderer-client-id=6 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A0F7A94D0475BF81366BCE167B7D6A2E --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
2c51de2f12ed451ada5ab50d17f46357

SHA1
87c9f730aa8fe03a8a6fc2ba7ab98c78fe0c1ed0

SHA256
72ba96fb6356840f15ebe52ec3d428da207d0d9033c8e76511a084c48f23ba39

SHA512
44ca88463ad08a95a9601c5b2a4d50fe8f64f51f2ec1bf5cb8779110941ea929fe1f9d0c3dd1489cc4b2d0428faac0f0ea78d120b637da5eb08cc100a42a1287

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
12c3cd5b4b81ffe5aa1749aa95e389c6

SHA1
38189cf181c8dfb2495de1539bdd91c0aa906dea

SHA256
d10b40441a6f49ccf050742154297e94a09eec149e533cc6d1f1e31592dba082

SHA512
93f3e22a2c61e541dffe4fbe356a650c53890dba0a2fd7d70ff99086ce41b22a9d79277c2a27a514e43602ec3dd8126e2c204c516ec1b172a478555524760bf1

Download Submit