Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 19:44
Behavioral task
behavioral1
Sample
7e2b222d75024c7c364651ef4d6e616a_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7e2b222d75024c7c364651ef4d6e616a_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
7e2b222d75024c7c364651ef4d6e616a_JaffaCakes118.pdf
-
Size
36KB
-
MD5
7e2b222d75024c7c364651ef4d6e616a
-
SHA1
44a493bac2815b73a4eece4e3a3c4c41cc5bf79e
-
SHA256
ac4617818afcb50cf38298fde07156e71fcdedae2249385c4f3c92c476d84ade
-
SHA512
3d7602791b2816740d82b6c3ea048fb04e7486651a9aad67e78112aeb360d40b522bbeb2a1852ec16e178d34931b54b041228ddaf683e933825ccaed24260be4
-
SSDEEP
768:KXuMZmwgCLWarPdgGs2fpXRtIwQD6PoFH1gcvbvuJcr:KXFZmGWSxhTu7FH1g3Jcr
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 928 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 928 AcroRd32.exe 928 AcroRd32.exe 928 AcroRd32.exe 928 AcroRd32.exe 928 AcroRd32.exe 928 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 928 wrote to memory of 4564 928 AcroRd32.exe 91 PID 928 wrote to memory of 4564 928 AcroRd32.exe 91 PID 928 wrote to memory of 4564 928 AcroRd32.exe 91 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4336 4564 RdrCEF.exe 94 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95 PID 4564 wrote to memory of 4256 4564 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7e2b222d75024c7c364651ef4d6e616a_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C8AB6F4D32AAA82C7E8FC273DBD3B20 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4336
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5700B23E7118452C84A8B7D780A6255D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5700B23E7118452C84A8B7D780A6255D --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:4256
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0BBDEE632B8242E11C2A16910F729EDE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0BBDEE632B8242E11C2A16910F729EDE --renderer-client-id=4 --mojo-platform-channel-handle=2156 --allow-no-sandbox-job /prefetch:13⤵PID:4392
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=55C58E5FE5E23388A296C5ED0B095263 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3780
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=929994F1EA261038D6E64B3FF26B2851 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=929994F1EA261038D6E64B3FF26B2851 --renderer-client-id=6 --mojo-platform-channel-handle=2592 --allow-no-sandbox-job /prefetch:13⤵PID:412
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=70378999B30A28BDBA404C9632239475 --mojo-platform-channel-handle=2984 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4840
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E73B334D0F0F739A6AB9ADADD895ECCE --mojo-platform-channel-handle=2988 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5abf8429f47b74051918028090911358a
SHA185106b485d89d176382d31f701c43bab7f7e0c8d
SHA2563b91802bbd2021475f78ca19014fcaedca3121e447d31f8ab59c3f5612ad7f5c
SHA5121d413b4dc58db1966cce35046b0308ed9be99f045914b244815e99e50da0680d60bfd53ee3034c99aa90df7a86b74f9a24fd6a79a05394daa3d5a8b7a773c432
-
Filesize
64KB
MD5d2073d2b614158828f8ae0003351ffe4
SHA133e281380fc43079f13d936e2479cf5fb9b2e167
SHA2560f657a9e9425da4672b15f0332ac6c9fcedb0aa631d4fbeca387f835364b05a0
SHA512e1536ae7165c29476f441d73a1ba8fa6bf76a665c07b393fec02c69b996c4a6785aa18528a267dbcac104e9243b9b309193539c66da2d330a4ef52740c85355b