85df054da8922c7b3d67eb3b1f838b69c126a13a77001acb381c5e70c7b928be

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5d2e52942991e25cacdc18249b76710_JaffaCakes118.pdf
Size 39KB
Sample240613-qw1mcsvfpq
SHA256 85df054da8922c7b3d67eb3b1f838b69c126a13a77001acb381c5e70c7b928be
MD5 a5d2e52942991e25cacdc18249b76710
SHA1 e7b1cc142717cb7eb10a10822d53918d9568b9eb
SHA512 a33994f1ca8ebea657723c25f72ed8bcbdb344efe5a7d171c3d52be93731119537d3c770db9776c212ffe30218705b70d64e553a949ae4c1d9f26a8770e7ea48
SSDEEP 768:vBaRRbSQjJA60hoLa2znt62j+y/1Gh52x91jaVBVZi31pPKVRGPmYuODQ8asFD2P:ZyRb5jJt7Z626y/1Gh52x91jsBVZi31m
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2396	AcroRd32.exe
2396	AcroRd32.exe
2396	AcroRd32.exe
2396	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 5040	2396	AcroRd32.exe	86
PID 2396 wrote to memory of 5040	2396	AcroRd32.exe	86
PID 2396 wrote to memory of 5040	2396	AcroRd32.exe	86
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 4844	5040	RdrCEF.exe	87
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88
PID 5040 wrote to memory of 2304	5040	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a5d2e52942991e25cacdc18249b76710_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD6B70E626C5B33F39563BB4ECCAB272 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CF579F0FA1A4870E6ECD3750664B348E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CF579F0FA1A4870E6ECD3750664B348E --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7F6F65D32872544C472BAF241E44E812 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4552
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=926191E66AE9F500A2FE45805ED3514C --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3872
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=74B8E1A0CBD3D852263A00580F870EE5 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F8867ADEFF1E4065ACE2EB1D5EAF36EE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F8867ADEFF1E4065ACE2EB1D5EAF36EE --renderer-client-id=8 --mojo-platform-channel-handle=2396 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 a92d1ba5cb1941012ae2a9021c42a5b0aa38dd9f58ada01c9f9f5f79d6816598
MD5 6b444c112b63e7e9ca4dcde87d1cae64
SHA1 5bab095b42d068cf5daf6e5fc7290a9095f5e9d7
SHA512 bf8c896710636c91dd6cbf5938d2a6ab3cd234208979c2ddb7e4db05a3ab4fa52dd30525cbf9287edf2688012ac97f2a376c6e2c12747db1509238850305e77f
SSDEEP 384:yeMdThP0tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:20+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download