64ebc9d13ec4a8a4a7f6549c18caff802623ce3bd0f07ff75f468fedb7576ff2

General

Target

697211b89241ccde563a3aaeed683d8d_JaffaCakes118.pdf
Size

47KB
MD5

697211b89241ccde563a3aaeed683d8d
SHA1

f570494b54217ca45a528a63b7fd5824dd545a34
SHA256

64ebc9d13ec4a8a4a7f6549c18caff802623ce3bd0f07ff75f468fedb7576ff2
SHA512

6e4c2e281c66a9f00d61b57d61eaa425ab1d9948d3d6f4e9fb99f6d7db7ff7a8d867b83bc4a1156b24d92f4f7c6bd9a61fe7ebd8f39e48a6c54edf5d0f5de13b
SSDEEP

768:93XuMZmwgCLWar3nMNyGbD17QZ5cn+BmDqXFBiieq9WEJudD8LnZ:xXFZmGWS3nIpl7ashEBiieq9WG28LnZ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1396 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1396 AcroRd32.exe
1396 AcroRd32.exe
1396 AcroRd32.exe
1396 AcroRd32.exe

pid	process
1396	AcroRd32.exe

pid	process
1396	AcroRd32.exe
1396	AcroRd32.exe
1396	AcroRd32.exe
1396	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1396 wrote to memory of 640	1396	AcroRd32.exe	RdrCEF.exe
PID 1396 wrote to memory of 640	1396	AcroRd32.exe	RdrCEF.exe
PID 1396 wrote to memory of 640	1396	AcroRd32.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4996	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe
PID 640 wrote to memory of 4692	640	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\697211b89241ccde563a3aaeed683d8d_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5B8E1B670F1069FF6EFFF88A252EA189 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9BCF323E61111F564646F7A621E154B4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9BCF323E61111F564646F7A621E154B4 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0052ED10928F0D3452392E1DB779F75A --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0531344301C65FDDEAA653F6E7E7B3C2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0531344301C65FDDEAA653F6E7E7B3C2 --renderer-client-id=5 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7BB2AF66351CB8EBBBC6F1FABC36C22C --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3980
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4DB316FD5FE9B0DA8753413366625FB8 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a562900023e22098ad7641b5509a099f

SHA1
b8eaa57bfd57477d86e797a259c0b2187f61fe27

SHA256
b4f5dacce4c6ce4af9a6356a04b942d8094a80264e5cdd8cf1813e6d44a9029d

SHA512
6d8cdc27978c67c0ac0de1765acbfa6e513b51ff1a904e932983aa98f1a609e14a58edddff6482a81d33bef86243b07bf5e71fe01445f73a12820c93f08f73f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
71a29a6550fb22c682e45d1c20df524e

SHA1
1cadb51fe4a1202cd33193ef4c87057cc9a97b78

SHA256
0fcad31189b5c621a2aac61583ed9d30f6729c51e51976ab74ab7a01c0d6abec

SHA512
21603ef9543c929fae6fad06f99b092619fe5552e19332e59793ff572cda2c32ea8e32ec2fba701dadc665391d48c8601253057c04d0e360473082fe984fe8cf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads