6a4d209fd409530a0cf9e790f1149d70cdfcffdba5a32ed2e0f2c1e0c9ea784e

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

666fc77f165c4757de84b06d36371cf4_JaffaCakes118.pdf
Size

42KB
MD5

666fc77f165c4757de84b06d36371cf4
SHA1

71b25aeb76b842aa220d01765acb61d2ecd03056
SHA256

6a4d209fd409530a0cf9e790f1149d70cdfcffdba5a32ed2e0f2c1e0c9ea784e
SHA512

8910d0125e4a8e84155039f0dc8a5425757bd8e028fc4428cf33764aa8d31c49df7c9981d1759b707b7b6d76200f01fe8127356819f6c1d8a52fb97efd55b19e
SSDEEP

768:nQEjdGTnJNCGk1L9dafN1G7UbfV1gl91vJqElVpOrwTr/UlolMI6fhu9hBRIXhPz:1huHCGk1/afyjl91vJqElVpWwTr/Ulom

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4316	AcroRd32.exe
4316	AcroRd32.exe
4316	AcroRd32.exe
4316	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1880	4316	AcroRd32.exe	93
PID 4316 wrote to memory of 1880	4316	AcroRd32.exe	93
PID 4316 wrote to memory of 1880	4316	AcroRd32.exe	93
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 2052	1880	RdrCEF.exe	94
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95
PID 1880 wrote to memory of 4708	1880	RdrCEF.exe	95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\666fc77f165c4757de84b06d36371cf4_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A8440DDE7A6893102010AAD9FB6BB04E --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EC6EEC6B541B3DD450EF753030FF2117 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EC6EEC6B541B3DD450EF753030FF2117 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2DBCA1749C8A7C7970621AF7A6C32BA2 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4408
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1C0E0DB85776C5B6D544EFDAE32085E --mojo-platform-channel-handle=1860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4932
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=21BE1B6B4125EA2D481D77EF7982B744 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=21BE1B6B4125EA2D481D77EF7982B744 --renderer-client-id=6 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1172
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=47E4EE0DD40C433B2316E7C929301FB8 --mojo-platform-channel-handle=2376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
d2b0558fa8c6a9f95502e38e2cbfb01d

SHA1
c63a5599226e8e563eb600bb5fe7358001a0b90c

SHA256
cfa205c129164f06815161fcd7a287ffe2ea30da589a0983abfd1e3eb3d9c66c

SHA512
16742a83385d0b3000b282553fd56379b30602651fa3ccf08a0a747a31336f3b6dc0df9d0e17a87f002fdd98fe121233fe69c6f9e03909d7c35ba6b054303acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
819e273b3f0dbca4beeac7e833d08593

SHA1
5c43ec443bb2623ad2a3f8c64690cb0d7b5b6ff9

SHA256
268d7b535dbbd742606648118a5155d94f241118464448944da1102ba1b06871

SHA512
52330837be611ceaf1ea32d98554bd24001d2809fac7bff98f52c3979e54e87b0d966a4fa35709e46eaa6dac13c17116feb4542918e70810be2f95718591ef31

Download Submit