15774abfde4a5777f2f736d3e860d99818140b7d494fcfe615ede0ad8490c0dc

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6078218396e33722969903912d36cf6_JaffaCakes118.pdf
Size 15KB
Sample240613-rt355sxarl
SHA256 15774abfde4a5777f2f736d3e860d99818140b7d494fcfe615ede0ad8490c0dc
MD5 a6078218396e33722969903912d36cf6
SHA1 6ab9d27ac2e6e477358919a4d3f87786b6abcd64
SHA512 f5723b0aab78dd0c0da967fe28f73e9fe9dcfb456bdfe4396d2b34ac5c4b93263d42e76db4891d8e3382ab148d8bbcafa93da518416357a5d3055cb91912ecfc
SSDEEP 384:dqPEJikLREPE9nmMk4xY4wy4CEljpdH2VVjA/OQiTv/:sPEd9m0G4wHpdHwVjqOHb/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3612	AcroRd32.exe
3612	AcroRd32.exe
3612	AcroRd32.exe
3612	AcroRd32.exe
3612	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 2504	3612	AcroRd32.exe	86
PID 3612 wrote to memory of 2504	3612	AcroRd32.exe	86
PID 3612 wrote to memory of 2504	3612	AcroRd32.exe	86
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 1864	2504	RdrCEF.exe	87
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88
PID 2504 wrote to memory of 3780	2504	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a6078218396e33722969903912d36cf6_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D06F945FF5E6849C9AE17BE04614F769 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1864
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0AEF5A871A0F0F598DF60757824B14FE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0AEF5A871A0F0F598DF60757824B14FE --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BA199F4B462B8305E2B039B09C0F94C4 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1416
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=17C020C9DC8D87E73555B91010441DC9 --mojo-platform-channel-handle=1912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1372
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E34CC539155F8F37D5F69B71BE3AD230 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7D1BAD1C522023169E634B8E85E34C35 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7D1BAD1C522023169E634B8E85E34C35 --renderer-client-id=7 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d2f26739f5232954a6ced89ee941d8f340b5acb880a32866e7c730fd26f40b81
MD5 0f7e7e9b11cde00f6095d0a49bfb7a0a
SHA1 abe31c6d870a154c31ab19a994dfcd84d4790ae2
SHA512 6d2a5a0ce6098a964b2ff97235c039df2c079bd311b361cf3cca6b538a2be02eb97d81f2708e635e10a290bfac1d35cb215f7271d2cfd9d4e85677a0f8ea1c10
SSDEEP 384:yeMdThPqtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2q+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download