bbb682035f8850fd286cd3320d90e5ac99ca9631a2502002323bc32ac3ba1c6e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6efe802d278f23a05d5b5c71553ac99f_JaffaCakes118.pdf
Size

47KB
MD5

6efe802d278f23a05d5b5c71553ac99f
SHA1

66f43aa101b210e347d62d317f3807a0655265e1
SHA256

bbb682035f8850fd286cd3320d90e5ac99ca9631a2502002323bc32ac3ba1c6e
SHA512

345319e8e70bbf4b99357dc47ab2cd794a9c519ed122b232ae914857259a596a9e6b97cdfdc1b037d3c0cd6ce07298ade697b8d597fc69680e86167bc17680b6
SSDEEP

768:RS3gGzpDyBVksi8SjB7OmH2TsCE4NSyxH3Oiv/tQza6TsNjUGYTWBpOXdr1nmaXl:lGFmnXOivVf6OjUGmqcthnmaXl

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4864	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4864	AcroRd32.exe
4864	AcroRd32.exe
4864	AcroRd32.exe
4864	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4484	4864	AcroRd32.exe	92
PID 4864 wrote to memory of 4484	4864	AcroRd32.exe	92
PID 4864 wrote to memory of 4484	4864	AcroRd32.exe	92
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 4660	4484	RdrCEF.exe	94
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95
PID 4484 wrote to memory of 2904	4484	RdrCEF.exe	95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6efe802d278f23a05d5b5c71553ac99f_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9CBB09DCEAAD236064B66D7BB6712EAF --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4660
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EF528C3AB17B695447A157BAEC9D9E29 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EF528C3AB17B695447A157BAEC9D9E29 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E79F253383D6C14E37AF3A6EDF2E7E00 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3564
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFFA5E9395EDAF19E466E2F79548F8D7 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3516
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DF6520FEF65DC7FEAAAFA6D0E584831B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DF6520FEF65DC7FEAAAFA6D0E584831B --renderer-client-id=6 --mojo-platform-channel-handle=2144 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FFC826FEEA0824E8DEAA8238ECBC5FE6 --mojo-platform-channel-handle=2704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
f363bfde6336f2e40520219c1c08dac5

SHA1
e1d72ade181780d8e539cd8a1d44af3c02d5ee16

SHA256
b37044ee2fabb95681c36dd43dde50cceec02c4756d5a29af58bcdc1703f7b59

SHA512
94cd89daad644388d0af762ab9cef36743ec0e60f9e257bd2fa636d47cc790cb93cdeae00db885d8673b3508e882ac31452c343f429e53bab20ba245b7438b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
f5ab91a913a458effae671581e60789c

SHA1
6a6b7112158e64c9e34b97e49371c091d0f90c9d

SHA256
2d16367842894090027b763deb2986421a7bdecd9aaf588fa472e9229460ba3f

SHA512
a238e20fd57cd09fad63614a3dce987862fc8ebd9668f9cdf458be6987a1fd925437c3e8acc285408064d04943176d780fc0b80c70ee918ac4e6d44a505ea5f5

Download Submit