489d31d06c2427e20f50358512f172f1886e3879b85cd2d2391f7019f2d04b0e

General

Target

65d595a4721a5e0ea6045b7d8a1433dd_JaffaCakes118.pdf
Size

28KB
MD5

65d595a4721a5e0ea6045b7d8a1433dd
SHA1

9a97af7261e4a353449473731b33b5f0a9cb1f97
SHA256

489d31d06c2427e20f50358512f172f1886e3879b85cd2d2391f7019f2d04b0e
SHA512

558cde3a27e081b93f4e1690d0d911b79fe9f5a4fdb54a1b56eb0cde8e02be6277381fd2293a4dcadfef96b195df16d7a0ae0bda2dbc0ed39485df9a40249034
SSDEEP

768:5X2mbMRMBdlPrNCMFzdaCH7U7kLy2gyKe8n7N:5X2crNl4CHw9yKFn7N

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3948 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3948 AcroRd32.exe
3948 AcroRd32.exe
3948 AcroRd32.exe
3948 AcroRd32.exe

pid	process
3948	AcroRd32.exe

pid	process
3948	AcroRd32.exe
3948	AcroRd32.exe
3948	AcroRd32.exe
3948	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3948 wrote to memory of 4340	3948	AcroRd32.exe	RdrCEF.exe
PID 3948 wrote to memory of 4340	3948	AcroRd32.exe	RdrCEF.exe
PID 3948 wrote to memory of 4340	3948	AcroRd32.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 3896	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe
PID 4340 wrote to memory of 1636	4340	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\65d595a4721a5e0ea6045b7d8a1433dd_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4340

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CC87A99A6B2FA13A94686AB6DA6555F4 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3896

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B0703CF62724CD2741E4EE37BF7C5C63 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B0703CF62724CD2741E4EE37BF7C5C63 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1636

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FB6F966E0CAC2CD6D0250E65145DF4E6 --mojo-platform-channel-handle=2276 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=879A1D37A8CC5E3989FD0BC41E3F196E --mojo-platform-channel-handle=1936 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BAFEB381EF1F11B1D5A00F971C18CE53 --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2296

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=71F73D00D909F3D9248726DD636FEFD4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=71F73D00D909F3D9248726DD636FEFD4 --renderer-client-id=7 --mojo-platform-channel-handle=1908 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a3ab42ca5897149254c0b482dc2b93f4

SHA1
6ec93fff7c487e23dafc677ffaacb1706b36a72e

SHA256
c41094dfe3c4c11debb14d5baa9be9ac06d8ba2743f006b2e43dbfa305be1ed9

SHA512
41ac9cfe3482b97deb8c85026f064661597162f0496b3ac176c421e0f8eb173186fb6da0047ee720dc84428440357648e661dbee15b7081eca074c2d8f7ef2f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a6b86ca1f4e709892b2d3ed34ddfd37d

SHA1
63bb03baac8e02eacefad942052324900ee9b25d

SHA256
249f8625d943e21dd050963a87655764cd532ebebad41a4531f39f4a032b924c

SHA512
60930e9b07092134d3bffc7d37b43d16ccf665fd0c68e13ea38b09fb71f1f113061d10d3246b6b17ce95b41677521919eba218cec96f3b18ab6ba810bc260bdb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads