f71626f36ced983aa1b2129c17c8c6f3e99bf288f68bec4097157835d0df26b5

General

Target

6390952ecc6d453b4b2ac6082303df60_JaffaCakes118.pdf
Size

39KB
MD5

6390952ecc6d453b4b2ac6082303df60
SHA1

367db89a767e4a9beba9ebf3ce5d33839ba306b9
SHA256

f71626f36ced983aa1b2129c17c8c6f3e99bf288f68bec4097157835d0df26b5
SHA512

1621519410892478b02836c52537d3a1f0d929db4543b3b30d31d1b8778add6aada482aff6640026a6df224d75ce55be5e69d11a87ddded3380f32e873814a06
SSDEEP

768:0bVgXr4xeZA4wuFfVOJPBHkcyM3r199GKQqSqDhlTddpRj8nvXObxE5tXuMZmwgP:mOXsd4w+fV+PBHkcyM3r199GKQqSqDh5

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1676 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1676 AcroRd32.exe
1676 AcroRd32.exe
1676 AcroRd32.exe
1676 AcroRd32.exe

pid	process
1676	AcroRd32.exe

pid	process
1676	AcroRd32.exe
1676	AcroRd32.exe
1676	AcroRd32.exe
1676	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1676 wrote to memory of 4844	1676	AcroRd32.exe	RdrCEF.exe
PID 1676 wrote to memory of 4844	1676	AcroRd32.exe	RdrCEF.exe
PID 1676 wrote to memory of 4844	1676	AcroRd32.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 1452	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe
PID 4844 wrote to memory of 4928	4844	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6390952ecc6d453b4b2ac6082303df60_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7274D9318C53484B8ECDDCB587C1C49E --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1452
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=388E7531517934A39C3095810F4874E1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=388E7531517934A39C3095810F4874E1 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C00F050F3D55FCD7C5A7CA4B7FFA4985 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4436
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=21878B9EA880C7B821FC54D32FE5A5E2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=874BF5201C40B87C4687D0D4BC1D54BC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=874BF5201C40B87C4687D0D4BC1D54BC --renderer-client-id=6 --mojo-platform-channel-handle=2108 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=78CBDAB1462FAB17DBBAA366BFC291EF --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
60ef11b3aa380e3eadd81fce6ea673d5

SHA1
9bb3650f8627470199dea14f74c376d840f9ade7

SHA256
fd26c0eaff4832d0784e3460749500fb64c18bc617eba469fb881a421c2105c7

SHA512
b070c6b2cd68e2357803f51ead845444b10d4e92470916682299aa90018fba5f056d88d6104fd730cbae6d07619f5795ae3ce9091f48b2ebf3c135de11bfc367

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4b297690976e087889697bb1b6cbf3c8

SHA1
43675b20dabb8ad95a426346b8d565786e1b0595

SHA256
49b522f870857e8d6f37266d187769247687f2e14c3d1a9c50dfb26a5aec9579

SHA512
7677cda69272741de5aeb76ed06cd4427f79a8bcc78404bf8243b86c0d2b6841deda09881986dca00ada7473fc7a774c733cbfca69d536723005c2cefce7829e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads