67a04c9478717510258711d92526ebdf1a03923ae3901b433f8a555445a42023

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a176135a0bc813129858c16ed11349d0_JaffaCakes118.pdf
Size 51KB
Sample240612-vr856awgmk
SHA256 67a04c9478717510258711d92526ebdf1a03923ae3901b433f8a555445a42023
MD5 a176135a0bc813129858c16ed11349d0
SHA1 7e8ba0e4b45829db40e452b436c920338b367cac
SHA512 f2398ec035c36ddbafbd50d19b6be5b92864b9e876c97d376f2bfd8e7760ed5486e2cdb70066a5c47f19199324b45b00a4632f2bbd5ee7f65f949f31d696f898
SSDEEP 1536:MGFyXJUd6m8OQX6MWZwbHeUL6dfcDCuaa/87IVd9V/DyNvD:pFyX9ebfc4R7IdVry9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
472	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
472	AcroRd32.exe
472	AcroRd32.exe
472	AcroRd32.exe
472	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 988	472	AcroRd32.exe	86
PID 472 wrote to memory of 988	472	AcroRd32.exe	86
PID 472 wrote to memory of 988	472	AcroRd32.exe	86
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3796	988	RdrCEF.exe	87
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88
PID 988 wrote to memory of 3716	988	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a176135a0bc813129858c16ed11349d0_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6D95082C43E4BAAD51C7E5FCEE612D17 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BEEC0DF18A6E1DCF733EFA0F16005F8D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BEEC0DF18A6E1DCF733EFA0F16005F8D --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9E31EF04EFBE2192A72A8DDC20BCEBEE --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E523C27919E396FE8B451934BF2EE1D5 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3544
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DA69E7C7A4231030B56CE4A8C177F2BC --mojo-platform-channel-handle=2368 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2380
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=850EDF7377396F55A3E791B7AD7EF068 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=850EDF7377396F55A3E791B7AD7EF068 --renderer-client-id=7 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 ad7170631bdb714b812b5a0f0c0f25fc011f358f4fb99b7b2354e428d0862f74
MD5 c2b5543d6828636388f70fa207611d6d
SHA1 f4d46b7f52326f4b7df8f50cc174077526cda606
SHA512 a360c8b5dd05e6a8a17e77a59eb207b4df56135a4ab0aeb692263946b169c4c9ee11febbe89323611fd738c3577e1e03a91af77cb6809a457f4e76a47abe4e56
SSDEEP 384:yeMdThPKtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2K+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download