04893d3cb38f3e594abafcebe66ae03e0c4ae3a7910a2ce97f4fed79a368d6e3

Analysis

max time kernel
51s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2b6392f2ad193b83cf24afc3604aa05_JaffaCakes118.pdf
Size 44KB
Sample240612-2fln2stamg
SHA256 04893d3cb38f3e594abafcebe66ae03e0c4ae3a7910a2ce97f4fed79a368d6e3
MD5 a2b6392f2ad193b83cf24afc3604aa05
SHA1 b6b69a68829a20e068bdfa7fda655fb63d4cbecc
SHA512 02d07dd08acab5086777a12e58120ba2211b64d1f0955d1005cd818c715eb6b7f4a20a5642a0abc8d439d40e43a95f0e12420fe46103f683c3963bc4513e6301
SSDEEP 768:IYxbTtmJGYm29zBR/XHPNHkMyh3mk1E9iK6q8cxi/e3ADvw1csyt0wtLpG9NB658:dR4P9zBR/XHPNHkMyh3t1E9iK6q8Zm3n
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4036	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4036	AcroRd32.exe
4036	AcroRd32.exe
4036	AcroRd32.exe
4036	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2680	4036	AcroRd32.exe	86
PID 4036 wrote to memory of 2680	4036	AcroRd32.exe	86
PID 4036 wrote to memory of 2680	4036	AcroRd32.exe	86
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 3180	2680	RdrCEF.exe	87
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88
PID 2680 wrote to memory of 1992	2680	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a2b6392f2ad193b83cf24afc3604aa05_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E7BE30B6224ED35612DA3CF2EA72CF83 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3180
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A12EEFA6999822F9C7FB8C81BB9F93B8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A12EEFA6999822F9C7FB8C81BB9F93B8 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F9DDB2E071D41AC1DC80118F6A7D2A96 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1768
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1A1036B588F6849532D02177F6C414DF --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4736
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=99BA75BFC0362EE2E5E4BC9D8D68FC29 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=99BA75BFC0362EE2E5E4BC9D8D68FC29 --renderer-client-id=6 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE56551B1823CF29604B81088E386B33 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 a4889805a2299993407289c162510132f30b23273e31bdbf1164c5fd5849c73e
MD5 ddd6cd5ba656dde5134318354aaf15fa
SHA1 99202609ee29e6b3f6facc7644515fc46c9636fb
SHA512 3c9f65ab1ea7eb936652fc7655430176c1d4809606740478f24719a95103b3fa5093f1a80cd44e3df50f17717dac01b93a7c1f26b45dc01de4a7b8a627d41379
SSDEEP 384:yeMdThPetELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2e+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download