495c92265c18bcf5ce87d73a76e9f6f21550f1826a1d2062256893e2f038880f

General

Target

a5ab0b018683c1a79e7bc7f52291b245_JaffaCakes118.pdf
Size

37KB
MD5

a5ab0b018683c1a79e7bc7f52291b245
SHA1

922df6aa6ef9d6bb70f11259b84983ddbb529b8a
SHA256

495c92265c18bcf5ce87d73a76e9f6f21550f1826a1d2062256893e2f038880f
SHA512

60ce45cfbf4e56b2821274205a9f0e2e0519e7300de9316883d3f59f5009a89d6bd32589dfef8d602151dfa34165443dd377e06b43bd7489631b1ba97f260041
SSDEEP

768:Yo70SnvjZCXMSacJVF1wK1PJFEIVgOrgTB/jl3lEIrhW9FBR7XmPYHkvyb3Q1e9M:YRSnNIJjJVF131PJFEIVgWgTB/jl3lEC

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

856 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

856 AcroRd32.exe
856 AcroRd32.exe
856 AcroRd32.exe
856 AcroRd32.exe

pid	process
856	AcroRd32.exe

pid	process
856	AcroRd32.exe
856	AcroRd32.exe
856	AcroRd32.exe
856	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 856 wrote to memory of 3732	856	AcroRd32.exe	RdrCEF.exe
PID 856 wrote to memory of 3732	856	AcroRd32.exe	RdrCEF.exe
PID 856 wrote to memory of 3732	856	AcroRd32.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 2360	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe
PID 3732 wrote to memory of 3768	3732	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a5ab0b018683c1a79e7bc7f52291b245_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CCB131F37DF283F6F5135B0ACE588768 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2360

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2E5E4032DF28A80909698FCDA124A5E1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2E5E4032DF28A80909698FCDA124A5E1 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3768

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F083B9FDC1B664307AA43278B6F85439 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=356E1AF540AB9371E5EC1E13E3ECBA79 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4216

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B79FD5CA8AF05B2C8BBA0C5CDA1E5CD3 --mojo-platform-channel-handle=2436 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4524

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=98CD752D07520981E4F718D93E56E87B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=98CD752D07520981E4F718D93E56E87B --renderer-client-id=7 --mojo-platform-channel-handle=1892 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
54fae768e8bbe764799ace07645a148b

SHA1
cf014fd9570c5aebdd355644716216d640d29aeb

SHA256
e908cef4edcbc03329f36f060fa87a0621d404ac508168537f626675c1e4e069

SHA512
48681e8b4342c54bafd6842f189a9e80070ef2bcf9b2c2ccd77ef06ef1358a7b72263010bce903ca0147f8fa4e36d875db4ce3d77cb572478e7d56c21310394c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads