4e9911900e49906caf45849f30aa5b4f1301f754b1f7062f369eed2b9d342cd3

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6b282f586ddf849370ed2bfbefacca0_JaffaCakes118.pdf
Size 52KB
Sample240613-1jjs7a1dmd
SHA256 4e9911900e49906caf45849f30aa5b4f1301f754b1f7062f369eed2b9d342cd3
MD5 a6b282f586ddf849370ed2bfbefacca0
SHA1 08846d71343e6dfcd95c34bc354731d42322f6e3
SHA512 870bf80be31ce2e42d55641b42f063e4090a0cb19b492bb521f107c5fdac7e2c5e42fa8ba5d9493d8f80e489e7fd010a88e4b1df10556ed6f338456cb93d0638
SSDEEP 1536:OGFBnPqu7ObRbENngF9+rWRJtYNugu+wH3GU:3FBCua9ENgF9SIY0guVV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 5024	3660	AcroRd32.exe	84
PID 3660 wrote to memory of 5024	3660	AcroRd32.exe	84
PID 3660 wrote to memory of 5024	3660	AcroRd32.exe	84
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 1532	5024	RdrCEF.exe	85
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86
PID 5024 wrote to memory of 764	5024	RdrCEF.exe	86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a6b282f586ddf849370ed2bfbefacca0_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C3E71A383D964F10F90901204B1910E --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1532
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=136ECD60EED0496F13707EE3CD361A8F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=136ECD60EED0496F13707EE3CD361A8F --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=54BAF0D5837E7B0C7C5239ECB3D9A315 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2376
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AD61920374E35FC999FE0F4BF241031 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4B7508756613BE7FF47ABCA5B55D1A8 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3340
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=62CC743827D845202868720EF9FFC2A9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=62CC743827D845202868720EF9FFC2A9 --renderer-client-id=8 --mojo-platform-channel-handle=2452 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 42bb8f9985e5dc14dce2b565380f176ca8a26b3c04c0712e9e6cd20b68e241a4
MD5 bd35dd1ad37a2b40b434bdee69d5d2d0
SHA1 9709e8b297b2dddbb4aa83cd11577c7bd04e9e8a
SHA512 6293c598f4ce7872c7d9ddbcb5e2dec87725c530bfd5749ad7624ec0d832ae3b844f0a064485457202a6a0cd28baf8f699fa00e2f170b1c00441820f3c9ffad1
SSDEEP 384:yeLdThPpvmEEtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:jY+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download