aeaa3c2310092d483eb140fd88d296d23a2c8bd73f51d284275b869fc7c13cd0

General

Target

65ae92f927e7cbd519887fa346a5b7e7_JaffaCakes118.pdf
Size

71KB
MD5

65ae92f927e7cbd519887fa346a5b7e7
SHA1

05fce5e63654e581855e0f42534c05d5230db7d6
SHA256

aeaa3c2310092d483eb140fd88d296d23a2c8bd73f51d284275b869fc7c13cd0
SHA512

179a2fda482cd36e68c2939968f264fda892d4e333de28ee956bf0161b56a6b899fa3033c93131106488037933113bdd0e1d3a78c4f9ae117778a7261ce38866
SSDEEP

1536:osN2irpYbomIVopv7x2joVpUcLUqaTPmi/pVWZhIdzUliQ9NtSXFZmGWSGT:osNtrabonqdFcoVpUcwTPLxV7zUkQ9Pf

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1008 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1008 AcroRd32.exe
1008 AcroRd32.exe
1008 AcroRd32.exe
1008 AcroRd32.exe

pid	process
1008	AcroRd32.exe

pid	process
1008	AcroRd32.exe
1008	AcroRd32.exe
1008	AcroRd32.exe
1008	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1008 wrote to memory of 2536	1008	AcroRd32.exe	RdrCEF.exe
PID 1008 wrote to memory of 2536	1008	AcroRd32.exe	RdrCEF.exe
PID 1008 wrote to memory of 2536	1008	AcroRd32.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3240	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe
PID 2536 wrote to memory of 3320	2536	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\65ae92f927e7cbd519887fa346a5b7e7_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2536

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7026B0A06378AE30EDF6CE0D424D9A38 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3240

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9DE02877CA01ACB80AB9AF1C737E3DB9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9DE02877CA01ACB80AB9AF1C737E3DB9 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=57151B978CB95E0223A57190039EC378 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D7FA8623E32C07052AE5147375E1026 --mojo-platform-channel-handle=2480 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3204

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=29B6EA8E182A401B14B14F26564ED5ED --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=29B6EA8E182A401B14B14F26564ED5ED --renderer-client-id=6 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1696

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CFC30EF4B763250628C9E8D478B6770F --mojo-platform-channel-handle=2868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
66a5702f7c801a79930139cb36c6c13a

SHA1
8c7fdabad198ac833313e9bfa35186b6bca15fb7

SHA256
551544b3d2840be8f4fcb030b153625e451c301d68b181768d66908517e8bbad

SHA512
5e2cc01d8fea097e34a8a98e4b018eaed9608fa648ff5f6fc9f8deb033f17cd53a20d29018f5b20c419cd7abf786ecda3a460a4e096ff0d67bd13c53dbb5baa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4d445c9d6de4af9a80796e9d0990347c

SHA1
62bc63799a4dcf6836857876d034a97c25add5a8

SHA256
69b020f8daa18d2bb5746c3a009744ec554cf437dc764f99d7b066575c4352a7

SHA512
7d9855af1b300cbf7be1e2cbb93f39020e8d31d9f3d8172fc35866991650f794fc2ad55e94fb752aae3825df57f9482014741449125c6b4d77184e7bd0a7fec2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads