06e679a906c654e8c8286dcd0beb553db820e105028e0708b65802edbc812a81

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6b1670404592adda0df18e47400d0cb_JaffaCakes118.pdf
Size 19KB
Sample240613-1hvjas1dkf
SHA256 06e679a906c654e8c8286dcd0beb553db820e105028e0708b65802edbc812a81
MD5 a6b1670404592adda0df18e47400d0cb
SHA1 27a60b8653101300187fc7aad4fd2530ed475e33
SHA512 0b87fb987b6ced900f302387df25825815ad69b2939a4f5ff6a95f29ac896238285e1a3706a68f99ad353fc71a61ddf992274e433c2a8b65393a5cd18644286f
SSDEEP 384:VzM5Ob8cSHS7Oz1wZXXaT7dcpqRgVL4I8mHFFVzhSkQd0dUcFcbLpyi3f+rG8KMW:VzM5ObsyKz14XXaHdgqW5L8mHFFVt9Qr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
732	AcroRd32.exe
732	AcroRd32.exe
732	AcroRd32.exe
732	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 2448	732	AcroRd32.exe	86
PID 732 wrote to memory of 2448	732	AcroRd32.exe	86
PID 732 wrote to memory of 2448	732	AcroRd32.exe	86
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 1476	2448	RdrCEF.exe	87
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88
PID 2448 wrote to memory of 2868	2448	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a6b1670404592adda0df18e47400d0cb_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=24D72142B694FC7CD083F694DB94DE9E --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1476
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8C46329405CCF909904B89FFC549AEF4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8C46329405CCF909904B89FFC549AEF4 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2868
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A16160B9BA97119B56FB1FD3E4C097CD --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1732
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=338B08950A926AE2397692FDD6F3FEA0 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2480
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3530C6DC67801E5A841E77BA9288C2D3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3530C6DC67801E5A841E77BA9288C2D3 --renderer-client-id=6 --mojo-platform-channel-handle=2436 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2440
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=46A39D6AF254F3E39B159360389294ED --mojo-platform-channel-handle=2540 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d523d5176d1e46b276e4cdb1a12a249d96b0b9a4a00c3ef4088dddfefeaae006
MD5 79defdb17bfbcadce818de69b4aaa7c8
SHA1 ae9d21d31dd7569f8ba526ebe9d338e2ec6fdf92
SHA512 5d2daa4feba3b2c9e1819c5421e8dced3180dde0749960177336cb0a609b5713b58e572bae0ae75497907d15c8f74c5912ce807db58ac5004c196cba3dfa2455
SSDEEP 384:yeLdThPpePLDtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:j6+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download