858a09ebc8849409490ccd30c3f73bbe766c27707330e61e48fe90a5bffec8be

Analysis

max time kernel
142s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8551aa61bf416e039215924fd66dfb1b_JaffaCakes118.pdf
Size

50KB
MD5

8551aa61bf416e039215924fd66dfb1b
SHA1

44cfa7a761c699d7e509f276032e9e196fce5f6c
SHA256

858a09ebc8849409490ccd30c3f73bbe766c27707330e61e48fe90a5bffec8be
SHA512

20b425d6626bb57c033eaac4d2738d45853a5baa4bfb2d51245b49d2bb164e7317a60a28a52d2303a8ef3b22fba9efe5099d98a199d01fa6db9c1dd473f685f6
SSDEEP

768:UgGzpD2pCUZx3Qqrfm3+KjPTrC9Z6rzxjI1bSUEsrP9AKFVzAq28Iy8Zy720b:hGF6pFmuCbccr1PCVzh2Vy8Zy720b

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3344	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3344	AcroRd32.exe
3344	AcroRd32.exe
3344	AcroRd32.exe
3344	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 5092	3344	AcroRd32.exe	93
PID 3344 wrote to memory of 5092	3344	AcroRd32.exe	93
PID 3344 wrote to memory of 5092	3344	AcroRd32.exe	93
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 1996	5092	RdrCEF.exe	95
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96
PID 5092 wrote to memory of 4172	5092	RdrCEF.exe	96

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8551aa61bf416e039215924fd66dfb1b_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6169DAFD02733E99073350032A02E7D7 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3E4CE4666A2AAC984523D2B448A976A6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3E4CE4666A2AAC984523D2B448A976A6 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BF13A1F38F3BA462E2C700697D4C4055 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2144
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E579C5DD2703127B4B7BCDABF8ABA557 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2320
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=356E65C34D70D93CCD980EF1007FF898 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=356E65C34D70D93CCD980EF1007FF898 --renderer-client-id=6 --mojo-platform-channel-handle=2584 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A5BE9A04856DFFCDAD5289F457D3ECA --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
52ba948f8285499dc036a554f8f8da82

SHA1
13ad524591bf2d0bf0920303600b787ad3b64678

SHA256
7d28953bf6d6e5ba25be72ed34f1642202300dcd3b7f6c59fe13ca0c268f4843

SHA512
b4ef48b5da4666d063c3d9ef4788dfea645741992a148e0edc382af72984bf55e05f31d63b072e9c191e6cd6deaf2f7a8b5ac7b0202b48cadd2cbdba589893fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
485da670326cc7b5407eec597eb72025

SHA1
4bd725640b7446303b0f72e4916ce506fe2143a2

SHA256
6b1febd8ad667324299a0f6b29b0490147821c500dc7be7208ee475907ca6316

SHA512
beb498cac0282f2593f9e2053114435af8a2c601045d2ea2c25bbd464a8fb3f4144b5524c9a40ece26011a17929ee43f55f4a2cbe8ef4218f123a6c9937268a8

Download Submit