6e3a93c1540536e28855375e82cd63d605148640b2f493f376cb77b0ad856a1d

Analysis

max time kernel
141s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7616d3ef2d32156d6ac5605a61c1455_JaffaCakes118.pdf
Size 41KB
Sample240614-a4pxtssanm
SHA256 6e3a93c1540536e28855375e82cd63d605148640b2f493f376cb77b0ad856a1d
MD5 a7616d3ef2d32156d6ac5605a61c1455
SHA1 c7a3325170e7cd9007bcb7813d291feda85319bc
SHA512 4e30f70477aeb6eb010ec378de4c548a2002722d73666fbe6cb372253f74c7d03fb642c0bc1e4935b4811fb670eb403509f4d7e13cff6b5f7a3cd3bbea3baa92
SSDEEP 768:wSgGzpDcpkYKyLG3KlSF78f3BX2jWOLchDGpnRDyDI5W20kFZQVLJ:wPGFQpHSKBmfpRDyoWrkFZQZJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 1920	3584	AcroRd32.exe	85
PID 3584 wrote to memory of 1920	3584	AcroRd32.exe	85
PID 3584 wrote to memory of 1920	3584	AcroRd32.exe	85
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1344	1920	RdrCEF.exe	86
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87
PID 1920 wrote to memory of 1616	1920	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a7616d3ef2d32156d6ac5605a61c1455_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CC8A1D440FF9160D482428F13D31A931 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1344
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E4D7F3ECE8375DD83D3BB7901DF35AC3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E4D7F3ECE8375DD83D3BB7901DF35AC3 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36859A2103EAF560906B99D5D2E9A66D --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3264
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F349E6B7C774689AAF078CCD9ECAD7C6 --mojo-platform-channel-handle=1912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9EFE2AC6FE111FC2FF66BBA94FF5B285 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5008
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6DAD4E57254D6304089E7C017255508C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6DAD4E57254D6304089E7C017255508C --renderer-client-id=7 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 a8a05f70a3e26b54496141885485809c7af7852e5c4aa886d2ca9c3e4fef5354
MD5 32e0e0076c7b03db3833ff6e680bec47
SHA1 0755d82bd7c3e6e51b71af7d4f5644e6d315270a
SHA512 8a10ec91a0d8ead0ae898282f1dbb192922881b6d2c60ed67bc09c167980b30f16f2eee401a7445714818f540de66a0c533e959e7f12bbdf312e31e506f280df
SSDEEP 384:yeMdThPgtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2g+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download