bccc755ec1230c19c174b4790293d05b7bc58c3c87aa5be55ea600a7fe545510

Analysis

max time kernel
133s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80a532264c7c6fada5d0ffafacc32a2e_JaffaCakes118.pdf
Size 50KB
Sample240529-n2tpwsdd4t
SHA256 bccc755ec1230c19c174b4790293d05b7bc58c3c87aa5be55ea600a7fe545510
MD5 80a532264c7c6fada5d0ffafacc32a2e
SHA1 534f7c30d754286987569de08175664c94481927
SHA512 b9295c015055554caf84311afab23dd80a248d614e01403902cc691b4bc752a51f6472caaa97a13d0b57a2d90d3160e1d5a4bb9a8769089e6184cdfc493e672d
SSDEEP 1536:cGFcpnp4Knslv9MH+exuVVR/4Mew31KzN5:5Fcpndns59MHZxuVVqMewlKP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1324	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1324	AcroRd32.exe
1324	AcroRd32.exe
1324	AcroRd32.exe
1324	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4372	1324	AcroRd32.exe	94
PID 1324 wrote to memory of 4372	1324	AcroRd32.exe	94
PID 1324 wrote to memory of 4372	1324	AcroRd32.exe	94
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 1716	4372	RdrCEF.exe	95
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96
PID 4372 wrote to memory of 2588	4372	RdrCEF.exe	96

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\80a532264c7c6fada5d0ffafacc32a2e_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6CF4FCAB828985CF32568D92A407EA54 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1716
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1CF9361197BE1B11A9771879C16BFD90 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1CF9361197BE1B11A9771879C16BFD90 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FA45ECA490966FDC76A3224AF2D80DE7 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4120
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E3B846BC35329E096D3B3D3559AD53D3 --mojo-platform-channel-handle=1952 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3504
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=97A7DD42C850FFFB700E604F0070C91B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=97A7DD42C850FFFB700E604F0070C91B --renderer-client-id=6 --mojo-platform-channel-handle=1964 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3260
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F23BFF40EC97FB0E1A8C7F0E50BB89B8 --mojo-platform-channel-handle=2364 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 0aca79e452d915eb369259759031ec8f539b9b976a6b4db7cf13e572e9628392
MD5 ec9c78ccb68a0b8e51f50b53cb1315cf
SHA1 8ceaa77eff7a6c3b5b7c96e2bf9802b60fe5a98b
SHA512 a2e62acd2198599d410b5b1f2a8b63c1dee3b11e4d83892f9650f649bf147e0eb5dd37a9f39dc2cb94fa4692f073fdfe7bcc1366e7d546c3609dbc5d55bdd564
SSDEEP 384:yeLdThP6tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:j6+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download