6119207a6a8562f298e75c3a5d97349adffb6f77cd97b86978cb542cedc267c0

General

Target

63d71c0e294e4d929adca615a195f666_JaffaCakes118.pdf
Size

71KB
MD5

63d71c0e294e4d929adca615a195f666
SHA1

0384872f128667aaf4a8844d7890cdf65b1a13ef
SHA256

6119207a6a8562f298e75c3a5d97349adffb6f77cd97b86978cb542cedc267c0
SHA512

7d3beecaf016969bdd2ce0c02afedb24beff85e48635561f52338a55e8f61bb3c769f90f8eb1b820913f1b484cdd95b1392bb7dde24573e3332f182d82b4f36e
SSDEEP

1536:8GF/pjuHh+AstRn1FEpwepiTKjhvFnolYini+DnoqLQGUr:ZF/pjuHtstRn1FE6epimdnolYini+DnY

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2432 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2432 AcroRd32.exe
2432 AcroRd32.exe
2432 AcroRd32.exe
2432 AcroRd32.exe

pid	process
2432	AcroRd32.exe

pid	process
2432	AcroRd32.exe
2432	AcroRd32.exe
2432	AcroRd32.exe
2432	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2432 wrote to memory of 4832	2432	AcroRd32.exe	RdrCEF.exe
PID 2432 wrote to memory of 4832	2432	AcroRd32.exe	RdrCEF.exe
PID 2432 wrote to memory of 4832	2432	AcroRd32.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 856	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe
PID 4832 wrote to memory of 1600	4832	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\63d71c0e294e4d929adca615a195f666_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=192F719F48004B3399F356204BFD45D8 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2E8750000E2D53871428B0B8EA92D1BA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2E8750000E2D53871428B0B8EA92D1BA --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=29D94A84943AB494C34DC10A6D9E3800 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1368

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8E38ECD068D1274480B4D846A130F2B8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8E38ECD068D1274480B4D846A130F2B8 --renderer-client-id=5 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2452

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F9E7D3E475DF404FE8E7C9BE170A042D --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5000

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D81DB6470E190C6A611C7BDFA5DBCF30 --mojo-platform-channel-handle=2904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4767f3a3bab1d92f1d2d98f3925badc2

SHA1
03d3002817a4dfd6cc75cc6abbafc317b014c39e

SHA256
a212aafba082dc02c5762c831ede4e6bd1219c1c2269e07572a5de55e082d711

SHA512
6e775959794f865506d1f9e4b9f61dbf38a2fa4a0d6d9e35c330324e9d4ce8e19602594f5e2645e6f760eaae831dec3f81edb4dad2cbf6d2919f3b71f58e631c

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
f2ff4f43b629e8b7f1c32ecfd775ef79

SHA1
4fae0e2e95c4a24f9fee38733bfc99337884af27

SHA256
45160db57700453f72a4de3c8e476a28c080a930f240b05eb41e1cfcc27a7648

SHA512
34a2f9a08d40c9e9472e3e36814b04c8f6d732b77e28e6644c589fd1d4509184b2ffdad334fbb87718ba30407d4d520b17ff34b7ea4dfdaac004b29a4f13681c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads