4096e760abae758433ef3c874bb640ecfa3aab1b4855eaec08ed360a33744186

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80a25935577dfb9636d71a9eddcbc369_JaffaCakes118.pdf
Size 107KB
Sample240529-nz5pdaeb22
SHA256 4096e760abae758433ef3c874bb640ecfa3aab1b4855eaec08ed360a33744186
MD5 80a25935577dfb9636d71a9eddcbc369
SHA1 9721fff54914a77d62d11d640300b4e3bd4bab8c
SHA512 91cfd0a6ba8fc6fd94780a41ac63ee71d6b5767a7c33fb590a84f96a3ee0de826d215074de39f3021e65fdd827ba76a4f95a2daae988c6d3ed8721432da7032b
SSDEEP 3072:hysefI9BGZRys0jwu0mCQaARUoIXdh1XmmmmmQmmmmmN:5rGZRys2JpqoIN2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2192	4868	AcroRd32.exe	92
PID 4868 wrote to memory of 2192	4868	AcroRd32.exe	92
PID 4868 wrote to memory of 2192	4868	AcroRd32.exe	92
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 3452	2192	RdrCEF.exe	93
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94
PID 2192 wrote to memory of 4840	2192	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\80a25935577dfb9636d71a9eddcbc369_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9D5EC3EC538BE48BF968B29C518A6926 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3452
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4938810F02591CC8331092DE297AAFA8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4938810F02591CC8331092DE297AAFA8 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA18578E15A6797C3D68E40292EF758C --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2228
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CBA02BE99A4EB93C1DF9346ED2C5D8FE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CBA02BE99A4EB93C1DF9346ED2C5D8FE --renderer-client-id=5 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:528
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7E1E2D569EEF47D8052E3D9EDC921464 --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:732
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8E27582BF5453C1578F1B64B703E6B4B --mojo-platform-channel-handle=2832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 8a3d511b594c802adaa4cecc850a21f2cb6712d616329a3d05b8892b7e025c62
MD5 0711261ffa333e2537e0ed4d5b41b7e1
SHA1 a0b009e36ece3a62343ff058ae76b5d31c361b2b
SHA512 53a673d037c08ef4cf95f0224ad9a3a88d0ba33660662715b759da5e4e1d2f0c3da6bc8f17800a5392937d20b3490fd3c78f182cad5791eb5c2e942939386b13
SSDEEP 384:yeLdThP2tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:j2+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download