c6b481c11181a173673052e3add58e48da5f07103cd5a02312cfa044c843f0c4

General

Target

6935443e49f8d65196333a51315eecd6_JaffaCakes118.pdf
Size

185KB
MD5

6935443e49f8d65196333a51315eecd6
SHA1

0ddd0ab6c3010f4e253a3332015bccea60e59ed0
SHA256

c6b481c11181a173673052e3add58e48da5f07103cd5a02312cfa044c843f0c4
SHA512

083b6fe947ef45085cfaf4c5fa295d6e743e1e5a50cbc842b26df77c7915b2d678ae48a1c0e4cf4b135c58a59c6d362554ccd00a714747f0e1aa8f447389da2c
SSDEEP

3072:z2irbxzGAFYDMxud7fKg3dXVmbOn5uK6Kjni2cEbbGk7rRdvGqmw5vrZSn:z2MKlWQ7Sg3d4bO/i2zNrzA

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4020 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4020 AcroRd32.exe
4020 AcroRd32.exe
4020 AcroRd32.exe
4020 AcroRd32.exe

pid	process
4020	AcroRd32.exe

pid	process
4020	AcroRd32.exe
4020	AcroRd32.exe
4020	AcroRd32.exe
4020	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4020 wrote to memory of 4428	4020	AcroRd32.exe	RdrCEF.exe
PID 4020 wrote to memory of 4428	4020	AcroRd32.exe	RdrCEF.exe
PID 4020 wrote to memory of 4428	4020	AcroRd32.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 660	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe
PID 4428 wrote to memory of 3496	4428	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6935443e49f8d65196333a51315eecd6_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C8060BCF232C4ACF61DD3269E666B2B2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:660

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=125105F534CA0704BFE445D2AF339A1E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=125105F534CA0704BFE445D2AF339A1E --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3496

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=90D4DFDA5B04FD72B013430493023FD6 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B180E7AC05EF2886724E1E9F04C52073 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B180E7AC05EF2886724E1E9F04C52073 --renderer-client-id=5 --mojo-platform-channel-handle=1848 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1068

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1D20106550019E7A541049EE15BA57DA --mojo-platform-channel-handle=2440 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5000

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=567704B80418186F7B0DFFFB106EE363 --mojo-platform-channel-handle=2772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
23a99d85500c91d11b5d653c3bbf5dad

SHA1
eb6682906602b028d410a9310d6cf5f7823663ac

SHA256
849e72497718cac768907f2d07e9d77da0e89507760f966f26b311898fa547c6

SHA512
d4ccc4efcad20ff0b19b0eb23a19da64ae9dabaa05d1fafd9bf14c98ef945921be3fa36e30d21427db7e84afd717d63332b81378dce65e7aca513c4425e053d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
b5d7b6adb6a4cc50315837990689aac6

SHA1
6c249c753a0b8ee081d26dcb8d00dd09047750e7

SHA256
7c14bba64a1a3f6b7cdd6ae25c22348a92bfffe52bfcac41215ff0d4cf74e22a

SHA512
99d7bb9dd0ffad8687996cc8dd2cba2698cdd6582379107391b2d1cba3c2e12d9cd09289c06956d3271f8a703da00e55e3d637420f7db9df488617a5b7494ffb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads