ae0077cf4410d3b443f2db80e1f36eefd63c2b3f05a23baf9e71fb1801ed3c75

Analysis

max time kernel
141s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6667d67f41509d5a7bee3347d03c9f17_JaffaCakes118.pdf
Size

39KB
MD5

6667d67f41509d5a7bee3347d03c9f17
SHA1

5c8b74f0f91f57d5e4ccee97f23b1af8f08dfbab
SHA256

ae0077cf4410d3b443f2db80e1f36eefd63c2b3f05a23baf9e71fb1801ed3c75
SHA512

c64b5454812bfc668cebcade4f6a51bcb946a73ab23d80007d36dd3d07c1519092028871106de3a0d2f810ec0a92f709d6b16fd7451e86c60f403619d90f3f46
SSDEEP

768:rgGzpDRWpvApffQaswHNJt35Zy+7w46twLZ50gIFg36WIz/IaTB5O:UGFdWpvCp7P6u0gIFw6WIjh3O

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4304	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4304	AcroRd32.exe
4304	AcroRd32.exe
4304	AcroRd32.exe
4304	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 376	4304	AcroRd32.exe	88
PID 4304 wrote to memory of 376	4304	AcroRd32.exe	88
PID 4304 wrote to memory of 376	4304	AcroRd32.exe	88
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 1640	376	RdrCEF.exe	89
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90
PID 376 wrote to memory of 2412	376	RdrCEF.exe	90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6667d67f41509d5a7bee3347d03c9f17_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4287FA45D964D2A74978F187FFF53C68 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1640
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BD9E9954D12171E5A0FBD9C706E40503 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BD9E9954D12171E5A0FBD9C706E40503 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=74CCAD72D18D7BE9B65AA3C074BC2A69 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2424
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=20D90E022D140AF5BF05D383F7E97928 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4156
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E08463564BCDF6E257B3ED71BA4577DA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E08463564BCDF6E257B3ED71BA4577DA --renderer-client-id=6 --mojo-platform-channel-handle=2532 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=993F678535435A3481FC3A646A6B0ECE --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
654312efb4ed43fbcfdbecb718b0a8c6

SHA1
61b8a21daac3964f59c6b1a12d11f8ff2875a92f

SHA256
24c540f4ce0c515a221c4f8a90ed41347f323646861a6c64e1f097de8d9c33e7

SHA512
9ca8d567c460c73609fc5858bc21a19ed58c23eecd6d842485bd52d5303694ed929edae4ee7053d1b36f1a762978d97b3afe4ef68831ae2595dca597a4916c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
cbbf94c1de692e65b59e4b26b1552800

SHA1
c7722735a66373b16f618c3b7751e4ac80142462

SHA256
7b37d1a8cc785a245fdb5eaebef1db65da758e0089a332a881ec637552e5c343

SHA512
6183612387f6907fc0c93d18f728e0e4e505e2c988567b4c3506d9b96eb2fc23191d05b8619b4adc54d7263fecdbc37b37ce795af645e9b42010454fa1624e20

Download Submit