Analysis
-
max time kernel
135s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:49
Behavioral task
behavioral1
Sample
65954e9886830723f9202633fe2cb746_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65954e9886830723f9202633fe2cb746_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
65954e9886830723f9202633fe2cb746_JaffaCakes118.pdf
-
Size
40KB
-
MD5
65954e9886830723f9202633fe2cb746
-
SHA1
f65cdc5a626525e8587662b391b7431a0ecb84f5
-
SHA256
120f6862f4ed0aed90775c1fd7e3f5210f9ddf597148efa65759b889fb0aa201
-
SHA512
9bc449cb8110c6f5ccecb989989cfccf8bae1e21753d5097ef67b57661bd1938cedb010bdb7262d80f4b7da7ff69d84f9b163f9ef8a4e44fc0858cef5d72d09d
-
SSDEEP
768:fgGzpDKpfOB/x+Yt1SaErQc/OK72XPGCxeyGvD/Inr1z+FTAZ0PG:oGFWpf9amOKtSELmCo0PG
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1420 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 1420 AcroRd32.exe 1420 AcroRd32.exe 1420 AcroRd32.exe 1420 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1420 wrote to memory of 3012 1420 AcroRd32.exe RdrCEF.exe PID 1420 wrote to memory of 3012 1420 AcroRd32.exe RdrCEF.exe PID 1420 wrote to memory of 3012 1420 AcroRd32.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 2664 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe PID 3012 wrote to memory of 1728 3012 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\65954e9886830723f9202633fe2cb746_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=20928EA6FDE7B5E62896A81BA0B1E3BD --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0B5857342D85CEADDAC0C328E02B3305 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0B5857342D85CEADDAC0C328E02B3305 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE93C6EF8F5B4592A8F3AA100B24AB03 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B5A85D191898B17810841673BF52A6A7 --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=086E1AF961A90E27C918A6BFF68C3C48 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=086E1AF961A90E27C918A6BFF68C3C48 --renderer-client-id=6 --mojo-platform-channel-handle=1952 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=24C82DF7F52CDF36DD44D831393CB3CE --mojo-platform-channel-handle=2700 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD5d51e6be484b2b4d01f7a375d411cdd31
SHA18d86d7c25148ac666a68dba23a47b4599e9521b8
SHA256c976a69a5f0bba49e7cad04f42a48fdcf3394980ce6014c09333bda78b06b359
SHA512857f4109a18d4a8844cdecd1c45e2976a9ccb456c1977a17c793c9727b372cad0bf2175ddf0478c6eb8bf266f565f8df9c04df30c1599fa88100dfaa6bbf8065
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD5d97c5f15cf285be7581ee1d611efa2ea
SHA1d91b007f123b58d207ff9644ea4a749806aae970
SHA256cc927e2fb6d3503903d953b55cdd4b96ca0092ca1004e81d01acda37848d51c4
SHA512ab40a6ff99d18748c02984c196038db65f78d9ad15a0633e6192cd08fda5fe0980168620b068b21ea0cd0cd0f20513cc6c9d4adddf8ab13142cf33802cdd023a