036939f12239a3fc7b7cc623a32b19f108bd7c247f5569d37be4963f237d580f

General

Target

a5a61b052973a7a7e279507b345336df_JaffaCakes118.pdf
Size

17KB
MD5

a5a61b052973a7a7e279507b345336df
SHA1

d6014b72353473085427b434a02c631280548390
SHA256

036939f12239a3fc7b7cc623a32b19f108bd7c247f5569d37be4963f237d580f
SHA512

d638f78e7542597c66524c3d512512550b938f9238b31359a0d62ddbc947367574e8a83a6dca60212007d3501231bd39ddf459010262d304efe59532c607a186
SSDEEP

384:VzfZw06z12xinjEESedvbaSPALGHdVZ9/XlXn1OeuLhcw18fQl93:Vzq06z1minjEESedvbaSPAaHdVZ9/XlY

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1300 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1300 AcroRd32.exe
1300 AcroRd32.exe
1300 AcroRd32.exe
1300 AcroRd32.exe

pid	process
1300	AcroRd32.exe

pid	process
1300	AcroRd32.exe
1300	AcroRd32.exe
1300	AcroRd32.exe
1300	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1300 wrote to memory of 1928	1300	AcroRd32.exe	RdrCEF.exe
PID 1300 wrote to memory of 1928	1300	AcroRd32.exe	RdrCEF.exe
PID 1300 wrote to memory of 1928	1300	AcroRd32.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 4540	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe
PID 1928 wrote to memory of 3916	1928	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a5a61b052973a7a7e279507b345336df_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DDC3B58A393047378E11A0D4C71AC406 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4102712FDA08F793E2BDB35B24570754 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4102712FDA08F793E2BDB35B24570754 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3916

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F3CAC7DE0CBAFFAB2D9A96730B44921B --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3964

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1F10EE4F9E876EE336E975A90BA32A29 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4872

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E44EC2F57A1F5D71AFE633BEF8DCD9EF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E44EC2F57A1F5D71AFE633BEF8DCD9EF --renderer-client-id=6 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3216

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3645FE914F1E2D97217A3D957BE56E9A --mojo-platform-channel-handle=2652 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
694c18f3438c98585aac1ed97a34cab4

SHA1
6f0c7cb5dafbb5476654dbba73a35a9eb69b8313

SHA256
08fc005dc33553e8d21dd28dedc6d31c446a6b138483668ccf23a64a2a6da743

SHA512
6e0b05717f8067654aef01814e9a0635572159751587be2767396474953f1f31624637b335c5a5f592918307930ea3c09396dcf19b9137bb4109838433bb5bd3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads