d7adce3988442f625fc93b605fcf2cf1dbad93ccb694d1bb4c020e8033d6267c

General

Target

a59fb72666c5cff011199e33f9393253_JaffaCakes118.pdf
Size

43KB
MD5

a59fb72666c5cff011199e33f9393253
SHA1

655a04afe451ab52d61a1470f0087c36293fbbd2
SHA256

d7adce3988442f625fc93b605fcf2cf1dbad93ccb694d1bb4c020e8033d6267c
SHA512

e1c7dc9e679c6088273db52623134564fa61c8e50a71b286e6d932b70d002e82854eb84299801301b1cb55d01322a4854e2817484d0ed5494caf1a1fc6abee08
SSDEEP

768:bgGzpDopQHWX81UcZZOXCtqxmXM9sPJOdAH//fyZR49pxpiHe+dL:kGFspQL+sROAnKZR4F8e+dL

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2896 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2896 AcroRd32.exe
2896 AcroRd32.exe
2896 AcroRd32.exe
2896 AcroRd32.exe

pid	process
2896	AcroRd32.exe

pid	process
2896	AcroRd32.exe
2896	AcroRd32.exe
2896	AcroRd32.exe
2896	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2896 wrote to memory of 5104	2896	AcroRd32.exe	RdrCEF.exe
PID 2896 wrote to memory of 5104	2896	AcroRd32.exe	RdrCEF.exe
PID 2896 wrote to memory of 5104	2896	AcroRd32.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 2340	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe
PID 5104 wrote to memory of 336	5104	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a59fb72666c5cff011199e33f9393253_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:5104

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FB7961FC08554BFCE21F63ADB19CD330 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2340

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B9AA8ADE9E92F353A8486B61398F25EB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B9AA8ADE9E92F353A8486B61398F25EB --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:336

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BCA96499FF8374960FCB9B33820EEDF3 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2004

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=74E04541AB431013A84516A8EE38A3A7 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4212

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7C30D33F342160E096ECA9CAA2770ACA --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5116

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=136E9B4075D45B118FCA0BFD2EA4EADD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=136E9B4075D45B118FCA0BFD2EA4EADD --renderer-client-id=7 --mojo-platform-channel-handle=1876 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
ca59071148e8098936cbcfbf3a62b5df

SHA1
c4043bd4bc47ea565b73f583542ca37509c53d99

SHA256
47aeb980448f91b2a697baddaa654f7593c01385ca9ba48e7663514d9434b862

SHA512
e3ebfe4d77f4a299c58f366bab81031a3628d7ebdf70bf74ad2facc978e2c023b205584c24fd6c0218735d681b5f2b17bb38c94dda918caf383200b1cb4c832f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads