a1905e066833507529a006dd635737708dd1cda318c1ff45cc3bda3dffd4c10c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83a92cd163609669e88d83942ec70c98_JaffaCakes118.pdf
Size

44KB
MD5

83a92cd163609669e88d83942ec70c98
SHA1

29fd0418298cd54d9d68a6e99fe8b32925e85027
SHA256

a1905e066833507529a006dd635737708dd1cda318c1ff45cc3bda3dffd4c10c
SHA512

495912eda7caa268961ea46c0efa0df15de04bc48a26178f87af1352968c26cc7110e2330a3a14f779b54d661bd9bf99a97bad387e05b44f3848f7687c9c7b46
SSDEEP

768:fgGzpDSuHbfeUSmdt5G0wMZVLNIBg3y42Z/YbahcOFuADc9qs/AtsfiybkbgNT:oGFzPxBZVLmBpFtDc9b4yfd2gNT

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4452	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4452	AcroRd32.exe
4452	AcroRd32.exe
4452	AcroRd32.exe
4452	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2092	4452	AcroRd32.exe	86
PID 4452 wrote to memory of 2092	4452	AcroRd32.exe	86
PID 4452 wrote to memory of 2092	4452	AcroRd32.exe	86
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 4956	2092	RdrCEF.exe	87
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88
PID 2092 wrote to memory of 3644	2092	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\83a92cd163609669e88d83942ec70c98_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D25E4DB7A3AB9004F84F4C5A2DB24C35 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=591F13444070808B109B7A4DC48EF03B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=591F13444070808B109B7A4DC48EF03B --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DC100EFD3AFE5206001C531204CA26A3 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=33D50F2EF288B564F29E3FC93E01DC43 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4816
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5E970F4DD0D5CFAA148370B50DDD5E21 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5E970F4DD0D5CFAA148370B50DDD5E21 --renderer-client-id=6 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA1757DFCDD2E9EEED935F05D569471B --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
1187f1533032b36f003fd9d32246980f

SHA1
a9d5a9587f51e5bdc6de0cf8b3a333e412d67d3c

SHA256
607378d7fde7ad351947f6960f303afa45a00f180b455acf39e707672d19e92d

SHA512
c8b102fe3ea6da247592b1cb91895f8f5fd64d7633763586c3ec112692949ceaac8f4ec4244a7ff10642742349ecd7b76646d704c1a62f892252eee1b37db405

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
90e0dcbbe77560ecf2a1e6e4b8a8e660

SHA1
53ee3dbfb0f38846ad50f66d655205e249725ab6

SHA256
d1a44f053ab08e5a8a81faabd317d0a72b769528eaedc669fb71c479997bbcda

SHA512
edad9d3f22e515e4aaa1f43de87aecb8411fc47d780bea8836f80013a87bce137ec1191efa3ccfa61e3f4fc239fe098215b38b5f32af1cfccfefb259a366d57f

Download Submit