619057bab583de5aaa8ac4a94025892531dbfc9a31668cd2a36e8e3a318bd881

General

Target

658b4138811345c4c80c64e74c08ff87_JaffaCakes118.pdf
Size

42KB
MD5

658b4138811345c4c80c64e74c08ff87
SHA1

c7eca42236b78c113ad7f6214b35694b03ccccb4
SHA256

619057bab583de5aaa8ac4a94025892531dbfc9a31668cd2a36e8e3a318bd881
SHA512

88398f56ecb6c4f2bb32cb29188f2f6ab97bf5806ae2628f16291ba9260dafb1c95e6534d8162d41ff009510508d25f8c660cd31f96c5865a6687ce1416bfa6d
SSDEEP

768:xXuMZmwgCLWarCE5HpuluxPrZoA7RyVvJ1RIT/PPhcQC+8MAKF0CxDlvrOnKVaTd:xXFZmGWSz8lGPrZoA7RyVvJ1RIT/PPh4

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4964 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4964 AcroRd32.exe
4964 AcroRd32.exe
4964 AcroRd32.exe
4964 AcroRd32.exe

pid	process
4964	AcroRd32.exe

pid	process
4964	AcroRd32.exe
4964	AcroRd32.exe
4964	AcroRd32.exe
4964	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4964 wrote to memory of 3932	4964	AcroRd32.exe	RdrCEF.exe
PID 4964 wrote to memory of 3932	4964	AcroRd32.exe	RdrCEF.exe
PID 4964 wrote to memory of 3932	4964	AcroRd32.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 4336	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe
PID 3932 wrote to memory of 2240	3932	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\658b4138811345c4c80c64e74c08ff87_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:3932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B34DCFA5A4F523952A6016CD658E1108 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4336

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E535612F2C0439434937EF89EB08C3F2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E535612F2C0439434937EF89EB08C3F2 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2240

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D636705F4B9913618AA15C37C82296A7 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4868

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A5ED337ED4B442972E20BEB2B3876F06 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A5ED337ED4B442972E20BEB2B3876F06 --renderer-client-id=5 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job /prefetch:1
3⤵
PID:624

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D3043DC918E97D7DAC8C392F3FCB4D6D --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BE5C4D3C488F277FCEEA5D606AD87A66 --mojo-platform-channel-handle=2928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
72c7717af7c633740f8f66d1e6afba29

SHA1
db8402e525b4cbfaf64f0e8693b95b306cd81550

SHA256
3357ce890419a5246b35442c7c4d08d1fba2092d2727bce6ca83cd842301a31d

SHA512
cc5d482c9ccc66591543e5a51e49b0edfd7a51b172e0736fa46f45368a05756dccd5b33e003521eabce17e75f4e6d0bb8fb8aad4f2ee29c3ad2e1025fbdfc9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5d12840d9d449eb049a862d21b120376

SHA1
79ddd68ba7cc91494a787ba3ac66aed6c16c7321

SHA256
066d1c93d4e484dce652e07ece39480d5895d32011460a77b615e7a01370e8ad

SHA512
0360e3cfb8f740155e12d52d671f111f17563b8ab7ef407759af9e2a7e59fe9f9f8971285336004d119e1a592bdc543328627ef560d6544c8c3ee435a2b1c537

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads