4a6e303e1737d2fe9276939f51fa0ee75ff4955e413cfc30a2fab464f8f54156

Analysis

max time kernel
135s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91210cc470bdec00d0339c09755b35ea_JaffaCakes118.pdf
Size

39KB
MD5

91210cc470bdec00d0339c09755b35ea
SHA1

550edba54a2be8fe0aeafed174a635abebe4bb53
SHA256

4a6e303e1737d2fe9276939f51fa0ee75ff4955e413cfc30a2fab464f8f54156
SHA512

b521cfc290534be60901ec1089908b808a960e689176797b11b438b170e4578e51ff4547abcf46719dfb9532dc57e6400b8a79f0018992829abd6e3e2f495a18
SSDEEP

768:MXuMZmwgCLWaroE5Hpxc9oxSuyazaxFGuKzdsAkAf7zIiODUuGSQxGFt5hn5XXV1:MXFZmGWSBjc9oxSuyazaxFGuodsAkAfm

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2264	AcroRd32.exe
2264	AcroRd32.exe
2264	AcroRd32.exe
2264	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4812	2264	AcroRd32.exe	89
PID 2264 wrote to memory of 4812	2264	AcroRd32.exe	89
PID 2264 wrote to memory of 4812	2264	AcroRd32.exe	89
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 632	4812	RdrCEF.exe	92
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93
PID 4812 wrote to memory of 4672	4812	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91210cc470bdec00d0339c09755b35ea_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1492BED4043016D695DBDB1D526E9892 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:632
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AB0BB6EFFF952332E6E4C7FD5BFB53FF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AB0BB6EFFF952332E6E4C7FD5BFB53FF --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8F025C3F4914227B3E53BF69E786A1E6 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2588
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=70E3B113030A6CB7D34CF134D5389350 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C3E6834C17CBB34C500CEDB7C49119D0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C3E6834C17CBB34C500CEDB7C49119D0 --renderer-client-id=6 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=912D261DC4AC2B8C35CED630C83D55F5 --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
be6d4f5d59e173997532fd37b4ad52da

SHA1
28676cd0706a65d13a9c5a7e257ad1385d2e0632

SHA256
db172b33f9e53bd68661503c94caabec6f17f11beba3b55c0cf01a6a8a4872e2

SHA512
36cd350edede73fedcab59a739e17e69915c435b8999232a487a209ed7d5e69a732e5446cf272ecb9806b7294a52e13b0774ddd14d1c9ee372908d6e304d3fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
8891c5779924cfe16146d56d06c86101

SHA1
9c4a9415d48e1fda1623f7d1667c505c9ddb386e

SHA256
e3dc594796b6c9ba8af3e4a294f2fd7fd7f62cbe14db61c29465f732b49a231c

SHA512
55534e786379b32a7b0da974c4444f13b4302cf9231e267b1433e9e0c0d612eb6f867d38d1a2c0c3b5f59c64bc63382eff78b92596a87af08d6e3bff64d822bc

Download Submit