497ef9a48db891f633ac4517777b6c3d243ee3fc9f4c651eef53017c99fa5b99

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a09f1619892d3966331afe51675fa1d6_JaffaCakes118.pdf
Size 31KB
Sample240612-pcbcpaxhkl
SHA256 497ef9a48db891f633ac4517777b6c3d243ee3fc9f4c651eef53017c99fa5b99
MD5 a09f1619892d3966331afe51675fa1d6
SHA1 d9039ffb80b0c87d2281987e508c6892cac7fde4
SHA512 dfb9c927f50ea88956c55eeeeeebd994a521d197e8358d575bef76916eff89a07c3684684874cc9aa1ffc4a45b3f67f623ab6d03c7f92ee451eb5feb630843b1
SSDEEP 768:TgGzpDIpVYiioZ4D+m5Owxw+nkiCVO3tgYgp2mbPn5p:sGFspPlswma22bPn5p
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3108	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 2668	3108	AcroRd32.exe	85
PID 3108 wrote to memory of 2668	3108	AcroRd32.exe	85
PID 3108 wrote to memory of 2668	3108	AcroRd32.exe	85
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 1324	2668	RdrCEF.exe	86
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87
PID 2668 wrote to memory of 2096	2668	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a09f1619892d3966331afe51675fa1d6_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=76CBA8B83B98FA855613EF0DD61F7928 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1324
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=62BD2AD0D5EA11AEBA8FF22D6FA62004 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=62BD2AD0D5EA11AEBA8FF22D6FA62004 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4CBCCF2075CC31C62A69AD941A35A3D2 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2860
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=47F37024FAA7E13801C6290D17188556 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1496
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B2930492236CA85A1B71C5B9B817EF1A --mojo-platform-channel-handle=2376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4876
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D23CEE561A99DF57367DD65EFDD775C7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D23CEE561A99DF57367DD65EFDD775C7 --renderer-client-id=7 --mojo-platform-channel-handle=1956 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 adff07b4028f8fe79714d4af3b83ba65ec73dea690e20eb7073ba33b16f86290
MD5 d091076b4d6682e24f5d1405b0d7452b
SHA1 c917873e1def1dc3373b6df3a02b595b4a532c60
SHA512 bf1e3511ce52fa439cbe7e0428b4c7130991d634696ea2a01dbc0ed71a421d3326a5886e80c47572276ce71a66ca778b114b4c41e86f8961e2ca7014b614eac9
SSDEEP 384:yeMdThP+tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2++elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download