572691c0a37567311447042fb48f1302c3cf6246d37d80cfbf9ca7590ef02c29

General

Target

a57176efd2d188cacfd31a79771040b6_JaffaCakes118.pdf
Size

29KB
MD5

a57176efd2d188cacfd31a79771040b6
SHA1

35ea3d1bf3fc2831efbe88031924d9380f5b424d
SHA256

572691c0a37567311447042fb48f1302c3cf6246d37d80cfbf9ca7590ef02c29
SHA512

d06a52e2dfef64ae77721e9804bb8e95efdb3778ea4846a0fb0fb20c1c34888bc36e83a3481388b5dc31d0b91e5bbe1f96cecb785ccd2be1cf02c983378dc9a5
SSDEEP

768:VzCzjhknzmhGjjva1kjiYd+UphHtzfrw9qy2jls/jzrvh3yFsOT9Eszz32Q8kW:laDwvC

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1040 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1040 AcroRd32.exe
1040 AcroRd32.exe
1040 AcroRd32.exe
1040 AcroRd32.exe

pid	process
1040	AcroRd32.exe

pid	process
1040	AcroRd32.exe
1040	AcroRd32.exe
1040	AcroRd32.exe
1040	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1040 wrote to memory of 2352	1040	AcroRd32.exe	RdrCEF.exe
PID 1040 wrote to memory of 2352	1040	AcroRd32.exe	RdrCEF.exe
PID 1040 wrote to memory of 2352	1040	AcroRd32.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 2600	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe
PID 2352 wrote to memory of 1304	2352	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a57176efd2d188cacfd31a79771040b6_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D1FFB9A9F944D003FEC5B6365A0A38F0 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A00793ED12866BB67BBE366DC92FD271 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A00793ED12866BB67BBE366DC92FD271 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1304

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=172288193004CE478152C1EF26C1CBE6 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3556

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=06AFDAA7D105BFAF42B29FDE67342A3E --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6F78F697AE9EA8C933DB1D220B66BE7C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6F78F697AE9EA8C933DB1D220B66BE7C --renderer-client-id=6 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job /prefetch:1
3⤵
PID:816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35CA8221394CD4B28263EAD995CE9788 --mojo-platform-channel-handle=2532 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
88d261e8bc86a82fd1f093c6b70cb05a

SHA1
8746a8c76a6d29cf278e68939e91a185a4d553d1

SHA256
aad09b8b571d096004ddb902cbe58ff076ec5060fef280de959739a26e0eaac5

SHA512
126e42c745dd2bff84f473199fda78126b825a18955d8d55e8eb0657ad74a87c1bb2f63fd727a27dcdcb5b41e2d74677f701b4cf7fc1cfbe4fc56673d73aa75a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads