3daeaf83a75c538f4986a29a1bbe86ad0f09ff2c3f4d1d9243b88972cabebe3a

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2c7fd2ad9d43693ffa5b70d46f8d32d_JaffaCakes118.pdf
Size 46KB
Sample240612-2rx68ateqh
SHA256 3daeaf83a75c538f4986a29a1bbe86ad0f09ff2c3f4d1d9243b88972cabebe3a
MD5 a2c7fd2ad9d43693ffa5b70d46f8d32d
SHA1 245c0e6af8847a9bb2775181ce2de99fd414829f
SHA512 03d5d8b7d5dd586ab54653c677655a70d9a601439f835e38ea248ff1d4a06edad61fa786182790130aa9e86d794855f3f9eeb3299f3b4ddbe5a4107f15079ed3
SSDEEP 768:ygGzpDZpcwwPB9suyFt2VSL/Y5tzI6wGtjbJyE9H53BHCXXRMc+EnCEe:vGFlpbQIJcj5xiXT+EnLe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1708	AcroRd32.exe
1708	AcroRd32.exe
1708	AcroRd32.exe
1708	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2904	1708	AcroRd32.exe	87
PID 1708 wrote to memory of 2904	1708	AcroRd32.exe	87
PID 1708 wrote to memory of 2904	1708	AcroRd32.exe	87
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 1620	2904	RdrCEF.exe	88
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89
PID 2904 wrote to memory of 3280	2904	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a2c7fd2ad9d43693ffa5b70d46f8d32d_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40193A443178D791A04700498A2AF142 --mojo-platform-channel-handle=1680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1620
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=400B907456737EA4FCEBC44B3309BD18 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=400B907456737EA4FCEBC44B3309BD18 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2542A795D73B5D39A922550E4F828EF9 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3C8A81D8F6B6DD87EF08CF633DBA170C --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2B8CB7A2556C8C49276EA9E428CF6E67 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2B8CB7A2556C8C49276EA9E428CF6E67 --renderer-client-id=6 --mojo-platform-channel-handle=1840 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9FDBF70D546D783EE58E137D4EBA309E --mojo-platform-channel-handle=2644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 645cd0ccdd2c0c96a9e16f534b3faa1355be48e6d48a480dc16df9239ca0f33f
MD5 d807c5f01a826a8d747740ab24d9f6aa
SHA1 4e57dda242c498c9933b3925f7df7f9b285d74f5
SHA512 d10695eb31e3552d657244d5d918286ab7f5cdb9e6afd55de5895882560a854f809ab3a27389cfdf1bc480e64b437dbea45569949194db686109cc4670964e1b
SSDEEP 384:yeMdThP8tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:28+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download