cf34df935208996d2274cbafd6fce8e72b5a160f1be314730289b8e6cfef89b2

General

Target

68d4985ed59b0fab057b79ca4dbf3ddf_JaffaCakes118.pdf
Size

358KB
MD5

68d4985ed59b0fab057b79ca4dbf3ddf
SHA1

d66888043a3bfaf64e0b02b33d01458d7684023d
SHA256

cf34df935208996d2274cbafd6fce8e72b5a160f1be314730289b8e6cfef89b2
SHA512

e9a00d7d9574b306dba0deb281b90fbfb378f87903b402dccc942ac71ec3f3dc371e60d670300718fa60d660264674e9d27682cd6cacb9e6f88add24f0f68f9e
SSDEEP

6144:+WpWOJ5FRAOjtGTsyJ59tEs/Jd1EjT2gkrFSu9TZsevkaADtSsCEIgL:dWOjFVpC9txEvFyFJ9TZssklIE5L

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4016 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

4016 AcroRd32.exe
4016 AcroRd32.exe
4016 AcroRd32.exe
4016 AcroRd32.exe
4016 AcroRd32.exe

pid	process
4016	AcroRd32.exe

pid	process
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4016 wrote to memory of 5040	4016	AcroRd32.exe	RdrCEF.exe
PID 4016 wrote to memory of 5040	4016	AcroRd32.exe	RdrCEF.exe
PID 4016 wrote to memory of 5040	4016	AcroRd32.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 648	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe
PID 5040 wrote to memory of 616	5040	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\68d4985ed59b0fab057b79ca4dbf3ddf_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16112E66D82E160544FBEC59D603D5FB --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:648
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4C56C640E76242E50B12AB6E13077BC0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4C56C640E76242E50B12AB6E13077BC0 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:616
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=28A8E58EA91554813FD18ABC05846B31 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1736
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B5E5364541C7E017016E440A549060B3 --mojo-platform-channel-handle=1936 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1232
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7D5563A9A832F04F3CB749C7573FFD7E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7D5563A9A832F04F3CB749C7573FFD7E --renderer-client-id=6 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=84E7332040FDD0BDF5A7B1816AA5DE93 --mojo-platform-channel-handle=2828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
71f1790b1ce9469f009abe70445e3da9

SHA1
a5c7ceac18f7ade910ca4408017b4fe239739eea

SHA256
df8f7b3d35780ad45eeda940970fca727e443b1c01cc43e82a18bb998df0e4c9

SHA512
35e4fd672c1dfb8580061a05768d618c2f565eca3e8b7ab60935e85b99a95a12baee8f73872e53c3ca9b7259449f2f047ffe04ae3b54e3c2f57e69ec99087512

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
9b5a1339598e77b88b41db59e9284d39

SHA1
9ebb81b30e58bbf5ef2714803210a81aa2fe6bd5

SHA256
54e2bcb15f8fad7ce726bd15e61e0b54c90971835fefd54a86d8b5d9d7ccde76

SHA512
d1bd66523ecd70a1ff5a71dd517f325c92077ab8faa766984aabeea1e09cd42ed7e88efb7f0e7423b206a5ef1129b0339763fd5b54a7b1f01e3b5d4be45dd1c7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads