0c8b0205c76925585265343ed89bd562487ef895ec8ca793162921b0e030604e

General

Target

a5677c007bd17260e9646c451a47684d_JaffaCakes118.pdf
Size

45KB
MD5

a5677c007bd17260e9646c451a47684d
SHA1

9d1c5db35957418f44c12e52dc55abd0c870c168
SHA256

0c8b0205c76925585265343ed89bd562487ef895ec8ca793162921b0e030604e
SHA512

19965c337c7950c19e6efc68534bd069ac8d525bdc69dd1abb4dee7071f004e9d595dc4c62e8950f29f30031d6348e2d1f166a2f1c8208d7a97d733978b14747
SSDEEP

768:yzJOs/pYP+Tcx/VjnTHSebVfdioeOAgTF7yy1Gf+HFSj6EqVPdE5kXuMZmwgCLWj:yVDpuWMFnTHSebV1IOJ00QOVPnXFZmGu

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4604 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4604 AcroRd32.exe
4604 AcroRd32.exe
4604 AcroRd32.exe
4604 AcroRd32.exe

pid	process
4604	AcroRd32.exe

pid	process
4604	AcroRd32.exe
4604	AcroRd32.exe
4604	AcroRd32.exe
4604	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4604 wrote to memory of 4892	4604	AcroRd32.exe	RdrCEF.exe
PID 4604 wrote to memory of 4892	4604	AcroRd32.exe	RdrCEF.exe
PID 4604 wrote to memory of 4892	4604	AcroRd32.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 4128	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe
PID 4892 wrote to memory of 1560	4892	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a5677c007bd17260e9646c451a47684d_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4892

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A23F4E834B6616C1465637EA7169C8BE --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4128

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=112A0981F422A6E0EDDD56B277827701 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=112A0981F422A6E0EDDD56B277827701 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1560

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EAB8F8FEF909479107DD8185A27593AA --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2148

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ACFEDF5DBA1F1ED75E02D524B2BAE3A0 --mojo-platform-channel-handle=2400 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5092

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F0EAE885AB4D1B1E4D43611AB6F3652B --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4936

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C7B271D52F114929F071D47D8F45CC54 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C7B271D52F114929F071D47D8F45CC54 --renderer-client-id=7 --mojo-platform-channel-handle=2488 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
84f6888cb6cb611f395c0da417fd3ddc

SHA1
162c56cc4fe3f2150e9639e85bb3c4d6a41bc14f

SHA256
abc0907926de9922d0e4e4e87950370c999daeaba3cd4c64d6f9fec1ff4148a6

SHA512
2fe2221b39760e59da8d00e5524fbbd269fb3b19a3da3a4fe4222e618380dc965ef3e1d59d09dc6f4b3ddb0f8f997883afc4d1e7dec0d397a2dda88f6b422fe6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads