260722226311e021cf8df9b0fddbfcf4b2fff9ded9ca69faeb88939d964a5307

General

Target

69719b4f20563a562ab6212aaa74dd95_JaffaCakes118.pdf
Size

46KB
MD5

69719b4f20563a562ab6212aaa74dd95
SHA1

2f727c523587f960f0451fc0996f9bbfb9609662
SHA256

260722226311e021cf8df9b0fddbfcf4b2fff9ded9ca69faeb88939d964a5307
SHA512

9c18c87385cddc1f0ac231e3486dcf528c41a5124f3f438c10ccae16137e9a3e1b50712782dc8d6e77170747ff8888c4fa5a81434ce0e9d1335dcb8d2f9f7ee7
SSDEEP

768:jXuMZmwgCLWarYUE5HpP0GP3uKt48i+fvHU1GWwhuHdrR4s75c9rUunQK/DMaQMv:jXFZmGWSYN11P3uKt48i+fvHU1GWwhuU

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3152 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3152 AcroRd32.exe
3152 AcroRd32.exe
3152 AcroRd32.exe
3152 AcroRd32.exe

pid	process
3152	AcroRd32.exe

pid	process
3152	AcroRd32.exe
3152	AcroRd32.exe
3152	AcroRd32.exe
3152	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3152 wrote to memory of 2188	3152	AcroRd32.exe	RdrCEF.exe
PID 3152 wrote to memory of 2188	3152	AcroRd32.exe	RdrCEF.exe
PID 3152 wrote to memory of 2188	3152	AcroRd32.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2912	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe
PID 2188 wrote to memory of 2920	2188	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\69719b4f20563a562ab6212aaa74dd95_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F5586A80B6F4EB6372D0D853F5DF68C1 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D0E0914213CCF3DDE1427DAC414A791A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D0E0914213CCF3DDE1427DAC414A791A --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2920

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7B810D66DB23E9060E0E864BC216E3FB --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2BCCAEA256DFAFDC1446D352247B0B59 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A3335E0F072443ED060ADA6A659038AB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A3335E0F072443ED060ADA6A659038AB --renderer-client-id=6 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1016

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D951959C0A977FF702A1754481262D66 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
3befeb9c08740f7302460abbc9ee5bca

SHA1
983cdbe3ad57ba535fe4fa565fa29a135d71d2d6

SHA256
3574bee015765f0665bfe7b1d168c58759d212a6fd15b6050f163bac67a793a0

SHA512
5589d1dc930421805b9c37349482bc20b6f76268e409760c279c1ff826c5773aa8650c8741481a0a3212c32b585e6f43ce91cac85db0b03ddb507564edaf8e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
52d41b5b4e327df8af38634d6bd1929d

SHA1
ecb3681e06d9df844a8f726eaacae207f7d10743

SHA256
fffe4b954e6126b5bb4215ad1bf975e848128018e899314ed0288bef36c8a37b

SHA512
b08913cd28afe210f6e56e2158406a902c4cc1f25d58fe6b456959250f688597ff2b0176d2744eb329f0a13993630e49d666fd68d9e1d0e0bae09d66e9b487e2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads