e6283db4f0c251f0d53bf66a749fc5e9c6f81d11c68818e8bb815b1f2b2aa038

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
914768fa7618e2b6152e3cac72e24d94_JaffaCakes118.pdf
Size 74KB
Sample240603-lejv3abc77
SHA256 e6283db4f0c251f0d53bf66a749fc5e9c6f81d11c68818e8bb815b1f2b2aa038
MD5 914768fa7618e2b6152e3cac72e24d94
SHA1 f4f2b867ac7c86472e41ed212bcd22b47dfafb44
SHA512 3e10aa551067a311f4d733a6ae2cb25061ac6c5ac131cdd88b30f7bf6e9dad4b4f8fe57b243f5affaba526a34031e7edaad27c2ada21b6347c9c9d8a066f9d02
SSDEEP 1536:uGFcyHbYAvO4zUK8D/e3zEeHuDq+p4av+GiMKZsNaw:XFcyH0AvO4AKO/2uG+6avsMusn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1200	AcroRd32.exe
1200	AcroRd32.exe
1200	AcroRd32.exe
1200	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1508	1200	AcroRd32.exe	89
PID 1200 wrote to memory of 1508	1200	AcroRd32.exe	89
PID 1200 wrote to memory of 1508	1200	AcroRd32.exe	89
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 4692	1508	RdrCEF.exe	92
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93
PID 1508 wrote to memory of 1496	1508	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\914768fa7618e2b6152e3cac72e24d94_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C7A33AD1E78A0F32B99B5EEF6A9227B0 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7EA9C8DD57334E6CF0A3EB5A02096782 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7EA9C8DD57334E6CF0A3EB5A02096782 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=459BD5F96A76E6D3D2C8A0775B13670F --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2068
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=572DD336D7350F4EFFEDAEFD66024C5A --mojo-platform-channel-handle=1900 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4180
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=585A79227B38D49A12F53B67CE01A811 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=585A79227B38D49A12F53B67CE01A811 --renderer-client-id=6 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1A89D54FC276973CFA671A4C445A1196 --mojo-platform-channel-handle=2532 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 9ae0c77cf6ad0a46ebf8226e692871dc5a9d8ca3d9c479c97dca7cc606508fbd
MD5 21fc983929d0ead981ebcab85d9f5aa1
SHA1 99df4433ae0630f7d91e1ef11ff769fd1bd58239
SHA512 4dcc3a42cbf2c85f525602554b59e72d332d4d798da786523d1d16e9a8807ca6466e259ef0d0002fdb5f021d396dfc50aae28e5e9b23b21234823ce79bee2a53
SSDEEP 384:yeMdThP2tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:22+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download