a605ec08f93b17b4911bc5eadc48eb944f90e57d15e58604c8cf051151b267e9

Analysis

max time kernel
141s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a454c249c82c03af6959be64e9a5dadc_JaffaCakes118.pdf
Size 18KB
Sample240613-htt3sssepj
SHA256 a605ec08f93b17b4911bc5eadc48eb944f90e57d15e58604c8cf051151b267e9
MD5 a454c249c82c03af6959be64e9a5dadc
SHA1 5e63531759921e176060775e8a8f17f688fec620
SHA512 dd78fd308e3837ba51caed0988d47507378bdb859f877868bf402b8dfea2be5c1bc0b27c64bb3f6d4e360c8c9d51232feb9381df7f252e4fc9a04a3fdfa985e5
SSDEEP 384:VzBOz1dmIOleKSIoYjsQinMAae27jv1Gd4dZMVqFiudxDBmt4svmMWLaZzLlsQ83:VzBOz1w9fSIoYjsQinMAae27jv1Gd4Ld
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4128	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4128	AcroRd32.exe
4128	AcroRd32.exe
4128	AcroRd32.exe
4128	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4712	4128	AcroRd32.exe	85
PID 4128 wrote to memory of 4712	4128	AcroRd32.exe	85
PID 4128 wrote to memory of 4712	4128	AcroRd32.exe	85
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 3696	4712	RdrCEF.exe	86
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87
PID 4712 wrote to memory of 4472	4712	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a454c249c82c03af6959be64e9a5dadc_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2AE51EBEFB8F276895FF9D52CE08EDA8 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3696
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=540931BD71DCA2EF937AB94E5F38CFB3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=540931BD71DCA2EF937AB94E5F38CFB3 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=24EA5C1DA71103AC18A821B4904587DB --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4856
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F00C072CD0370A0A4F13C0667108F62E --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3668
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8C4E31B6AE308F9DF50CFF620F1C1D65 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4656
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8E088A7A62996B0C155103292BE7430A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8E088A7A62996B0C155103292BE7430A --renderer-client-id=7 --mojo-platform-channel-handle=2524 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 f6ba74b48e866e0810ed6620416b5f1fce44064171822b7ba566c15dfc48a5ec
MD5 5b366d39036102a143b70a684de5d38b
SHA1 e99546c3008b1fc5cbfeabb02228463787103848
SHA512 f5efb219d3004a1b70f7d0aeefc235f0185ba872b3526d67d532a7e55906e5ae5786152e844e0fe674c9a96552f3c4148b571009fc72c49716091892b08f329b
SSDEEP 384:yeMdThPgtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2g+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download