Analysis
-
max time kernel
135s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:52
Behavioral task
behavioral1
Sample
912fd1584c3da11ad0eedd30b0dbc776_JaffaCakes118.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
912fd1584c3da11ad0eedd30b0dbc776_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
912fd1584c3da11ad0eedd30b0dbc776_JaffaCakes118.pdf
-
Size
45KB
-
MD5
912fd1584c3da11ad0eedd30b0dbc776
-
SHA1
e4cf1c7d89f5ae6c6f8b7680100a3729e4873cdf
-
SHA256
9ee8f860552dd4a65f331fbca8fdb1e16f0143a6a8bbad525cd51078dd6301b3
-
SHA512
9de7fd0ed9181ac0150815ca64ef2a29795034ccfe5ac868713446b7090b8ffaaf3a665fd58b81416fac69976535b18ef1d60f16cffe29d00f801c69b2f3c81f
-
SSDEEP
768:agGzpD4g2sBSue3NUFrI1ijl6TDxqiA/BeAF1GFi9VmPdIbqo3DD2sAPqaH:HGFElWwqiA/Ai1GFi+ObqozDB6qaH
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5000 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5000 AcroRd32.exe 5000 AcroRd32.exe 5000 AcroRd32.exe 5000 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5000 wrote to memory of 4724 5000 AcroRd32.exe 89 PID 5000 wrote to memory of 4724 5000 AcroRd32.exe 89 PID 5000 wrote to memory of 4724 5000 AcroRd32.exe 89 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2824 4724 RdrCEF.exe 90 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91 PID 4724 wrote to memory of 2292 4724 RdrCEF.exe 91
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\912fd1584c3da11ad0eedd30b0dbc776_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=684C9AA30E562CE98800410D23E1482F --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2824
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CD1CFD34F13B75D5EB1987A9C44BA791 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CD1CFD34F13B75D5EB1987A9C44BA791 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:2292
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41719A8E9FED7985940F1AAECC9B3859 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1152
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=912B99E66D4CD20DDF2CB5D98A8153D9 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1352
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2176A4D70B5ADDE927F63DFAB542AFF5 --mojo-platform-channel-handle=2376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3292
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=056B04017348C2BE786BE9A38E4B9CA1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=056B04017348C2BE786BE9A38E4B9CA1 --renderer-client-id=7 --mojo-platform-channel-handle=1924 --allow-no-sandbox-job /prefetch:13⤵PID:1796
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD56698f8f1a50c0be4af6d31566a304dfd
SHA1ae4ff91f58bec695f8b438ab9921f3deabf077b6
SHA2561ffc2e95b45ef24a1cb622e74791d68d32582409f66ded103c419a57b7b2a704
SHA512d99f9aea42a0dc9385652b2a1bbd3018d4a8fd8d63c144fb1f95383b145dceefce792463bed40e07b5f71244ad44d58e2f503ac871e44d370d0ef727ca3e1f24
-
Filesize
64KB
MD5a674a90a2f535172e0adf5ed00a63f52
SHA17eb14e56aa3fd8b1a7e72e9d7def8fc01c311662
SHA2561f8f7acfdfb5234e153d65f8d09f024f411ae75fa6e2dfd538e288e54bb65acf
SHA5121552aff8d4c0c84ae49bc604fc8bf885fc3e44626e97850dd1281c6aeeb8fc3fb2bbcfd05ad576875e62d9dcf21332779d74d7059e7dead0b768550eb418e8fd