Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 09:36
Behavioral task
behavioral1
Sample
a4e159ed34d7c243c62d87f9b523fa66_JaffaCakes118.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a4e159ed34d7c243c62d87f9b523fa66_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
a4e159ed34d7c243c62d87f9b523fa66_JaffaCakes118.pdf
-
Size
128KB
-
MD5
a4e159ed34d7c243c62d87f9b523fa66
-
SHA1
ee0f4c5cd812c48e296c0fd262aa3e821ca341cc
-
SHA256
ef4ee6313b5cbc7cef0d303d89ec1263a27603383fad7719b9e7d27d671b26c9
-
SHA512
d5383aedacc079d218181fd8402b99195e7e86bbf5f8d681c0445c6e3995f3fd91eecbb7fa3d99b66b9a9d9963b333b1814eba1a3b9a3f55f07ebe39795d3203
-
SSDEEP
3072:UysEpuvbX7Sn9ZV8Kfxwu3eEZhLEh9eHHcnYNsLyp:duvXw9X8KjeEzEhUHEL2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2356 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 2356 AcroRd32.exe 2356 AcroRd32.exe 2356 AcroRd32.exe 2356 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2356 wrote to memory of 1724 2356 AcroRd32.exe RdrCEF.exe PID 2356 wrote to memory of 1724 2356 AcroRd32.exe RdrCEF.exe PID 2356 wrote to memory of 1724 2356 AcroRd32.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 908 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe PID 1724 wrote to memory of 1764 1724 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a4e159ed34d7c243c62d87f9b523fa66_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8ADC53BCAA845FE2AAE683B921E9985D --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=94537DC68E992B3EA8972FF9C3ACA819 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=94537DC68E992B3EA8972FF9C3ACA819 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AC5D2350E918AE42A00CEC3B1202298B --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7FC8217202046394AA23C2310E106061 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D798BDDD54CA43DCF91B9BCDE3D4B227 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C6BCC88F81CDB64ED5D525B8C8B5E8DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C6BCC88F81CDB64ED5D525B8C8B5E8DD --renderer-client-id=7 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD5f1ccf53063dbf0b800263637244e4cfb
SHA17b34a3f9e013378c49ed0bf3e37baadc478aace7
SHA256c2e31e1703d0cca90defb79046996c27822bb58f4e07a8d85ecc70e6c91683b4
SHA5126e6124ec9372ed409cc7091006ee4a36cc2280945817955a9694f10c0e16d4be28d2277b132ad43a9a883dee1f532062fdc7b14400f7764dd4bd36d031b0b409