b55aea2a3b3f3a9d3ab5dd0cecd6a0e12b4dc1b9edbde5186dd21954558c8e17

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2e11ffb5477e582ccadff44d6ad24ed_JaffaCakes118.pdf
Size 42KB
Sample240612-279vysvbqd
SHA256 b55aea2a3b3f3a9d3ab5dd0cecd6a0e12b4dc1b9edbde5186dd21954558c8e17
MD5 a2e11ffb5477e582ccadff44d6ad24ed
SHA1 00fa3b99093e54d02098e96beeded9b1100e909b
SHA512 fbc86ce859aee4aaecd7b865c3c12c13a303fcde8f4fbe6614e22683aad6876ee1d8a420ab3e157dd988e32d55a6e7c24556aa318740b5c4ce9aa8c2c4ad5a30
SSDEEP 768:i7gGzpDmGkLITTBwO4TvC9EdA8HPea8N10NJYRkFJouKEApO:dGFq9HwiYRmFApO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2372	AcroRd32.exe
2372	AcroRd32.exe
2372	AcroRd32.exe
2372	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3500	2372	AcroRd32.exe	81
PID 2372 wrote to memory of 3500	2372	AcroRd32.exe	81
PID 2372 wrote to memory of 3500	2372	AcroRd32.exe	81
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 5188	3500	RdrCEF.exe	82
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83
PID 3500 wrote to memory of 4892	3500	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a2e11ffb5477e582ccadff44d6ad24ed_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41C3F120BB5FF98BE155668018E4BED0 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=787B266259C71D669F2495D4DD274DD8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=787B266259C71D669F2495D4DD274DD8 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A0430961FFF5BA044C91DB56A39CA780 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:6128
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4CF2A15801D40511687465BB00A52ECE --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1620
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A28D26D7090827BC051F4CDA0248DD30 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1832
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A4BB7B9C4AE9BEA56BF58B833469533C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A4BB7B9C4AE9BEA56BF58B833469533C --renderer-client-id=7 --mojo-platform-channel-handle=2508 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 70b417aa2ed568114060ebf05784140b7374baeb2d604377b6ff16ddb4c9b6a4
MD5 f0f5c5203e9fd1bce85f412011cb8036
SHA1 55fad56ebbfbe1e7cf4fd2931269dfcc1f001829
SHA512 59904b27d12b23867321e1fbf0f77944969925b3479ff236a6149a27998099e68e0892b0650dc5557ce1691f234aa030fb5ed93043358a52b814e61e6d18ae5a
SSDEEP 384:yeMdThPstELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2s+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download