38018c679292952a2d6fa1586c9cc97d544baf273b98f0c4d0c7332c0af2cea7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bcdf586caf558d479a52caeb71cf318_JaffaCakes118.pdf
Size

353KB
MD5

8bcdf586caf558d479a52caeb71cf318
SHA1

4ccade066402873b9a3b62e1abbe111c40e347f2
SHA256

38018c679292952a2d6fa1586c9cc97d544baf273b98f0c4d0c7332c0af2cea7
SHA512

9c6e531d4d8ca22cc6e5dbf73fd46b2182bb658fd5faba0b4194e6291a41571686379da0b2d2eec44009f4e7e108b7f224ded261bd554296d8af1c439704bc89
SSDEEP

6144:JzfVD58fYVopC6958sc4Z6F5kEHbT1Q4VvuIwtuyOlmy5We/zhLsbdIW:Jzfpz6pC4BZgkEHbZ1VvkuySmy5NLhLo

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4324	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4324	AcroRd32.exe
4324	AcroRd32.exe
4324	AcroRd32.exe
4324	AcroRd32.exe
4324	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4440	4324	AcroRd32.exe	88
PID 4324 wrote to memory of 4440	4324	AcroRd32.exe	88
PID 4324 wrote to memory of 4440	4324	AcroRd32.exe	88
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 4764	4440	RdrCEF.exe	91
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92
PID 4440 wrote to memory of 2164	4440	RdrCEF.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8bcdf586caf558d479a52caeb71cf318_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=48325D3D4CD0CCAE12F0273822498319 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4764
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BABC9E0F8152FE56BF1F0C22F37565A1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BABC9E0F8152FE56BF1F0C22F37565A1 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2164
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6634AEAC437C633063F66ECE1C686F5F --mojo-platform-channel-handle=2136 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:972
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A63F7DAA3A70D23F70B6926DD1B2634C --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2372
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8C5CE0F74DFF4B83559B08CE9557E851 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8C5CE0F74DFF4B83559B08CE9557E851 --renderer-client-id=6 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2992
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DA61FAE805E2E85E2470EA73BADFD8E3 --mojo-platform-channel-handle=2652 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
1720e20eea36713157e5f807a4cb4398

SHA1
c6b7531c9b7ec3cb55a9412f2bc42c9999b35aa9

SHA256
460ca208b1e7d9cea8f5669a1e3b897086d26bd6371de88606ad37ddc8e273c8

SHA512
4c57f0b9c3c363f6081fe3ab116e109d3fc778059750e4fc33a4d8c0933bff744e83d55a8b1959dec16f3212461c6468018065a8af346b5a9c379e4901696197

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
0235753c21dbd0b8dc46c8b92d736462

SHA1
169675941224ea6dcb2db7d78cd1477fa825523c

SHA256
89c7a5e52d0393139dc02dc089de1781e146af0b918e5239d7c96e622643554a

SHA512
b36c0b61e2cda24c6b1bf447699333bee9c2acbe936217763474f90e3a259a4c37420fd4b0a0ba13045193b943f87c7de6b345f3eb9d78c78aaa0a81d0ea7aec

Download Submit