Analysis
-
max time kernel
129s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:20
Behavioral task
behavioral1
Sample
696d661168650053b66c8b16fe56ee63_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
696d661168650053b66c8b16fe56ee63_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
696d661168650053b66c8b16fe56ee63_JaffaCakes118.pdf
-
Size
37KB
-
MD5
696d661168650053b66c8b16fe56ee63
-
SHA1
c4ae4cf41600693b2dd365f8e6e54aad124557dc
-
SHA256
599e744af163ee82620f4bd2f778889e136037b945a867dc5e1e4dd892b746ea
-
SHA512
61c48e502326bf270ae0b9fa089393c7f151baf18374d1ba5aca80b623f243e61db3ea7f74add84cc759cbb5c2cdda78c5e188272329bb5de8bec5b1537ffd44
-
SSDEEP
768:ggGzpD/ep0qr2FICb1kE15GRXkxrhbQvKvl31x/UGAHD+mT/QXlPWluPcn:tGFLepBMrhsv4LUGAjXT/GlPGuPcn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 4644 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 4644 AcroRd32.exe 4644 AcroRd32.exe 4644 AcroRd32.exe 4644 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 4644 wrote to memory of 2004 4644 AcroRd32.exe RdrCEF.exe PID 4644 wrote to memory of 2004 4644 AcroRd32.exe RdrCEF.exe PID 4644 wrote to memory of 2004 4644 AcroRd32.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 1352 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe PID 2004 wrote to memory of 4416 2004 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\696d661168650053b66c8b16fe56ee63_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BFF0FFA6D494428D53E706C728572DE5 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1352
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C6513B6EE443C57750986A32B43F526A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C6513B6EE443C57750986A32B43F526A --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:13⤵PID:4416
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=92BD8947D4098A69A00AA9DF9D559743 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1156
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C6C18B9D802A2F80EE930FC8A2E72C56 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C6C18B9D802A2F80EE930FC8A2E72C56 --renderer-client-id=5 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job /prefetch:13⤵PID:1844
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C6E2ED643A6E672AA60EF30B0B38B942 --mojo-platform-channel-handle=2740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4016
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=96030F4A22D93FB973F5BB515DD735FA --mojo-platform-channel-handle=2820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD567ab9ffcd24d971324e8936e1eb08052
SHA1fe0089c4df4914b5937c9d51cf98b0264dcbfbfe
SHA256fb6d5321a521a379c192f5de0f0ecbaf46fbe0b624e0c3d7c987b26f8b4d1e30
SHA51204d82c78aa850775243f650bb7b891fbda4ae01919865b87962060c50fe101d9da73b819089f0cc52929a83dac34e56b84327ad97844875fe0afd34bd7e01da8
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD56b23e5a285b070b8ad8fedf57fa4011d
SHA154054c3281ff527d3d29913153766f3dc7e67bd4
SHA2560439b99283b190c6887b0a702c8bc47bed16cc2009562b119a3a7a7f7d35c43a
SHA512b130859ad348fb52ce7420ef3a29845bc1afdca65e174c71cda693c613ffa8f38548cbc4092e76886a35b75f7370389a691626ff9f3480730259b6a67350911a