216eec7cb479459f2cca22aa4f05f700a7cb3042b9d1edf1058d5bcc7d2e044d

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9c57e5c4e1a26bfa9a3f98a82fa2306_JaffaCakes118.pdf
Size 32KB
Sample240614-p4gnsaveqn
SHA256 216eec7cb479459f2cca22aa4f05f700a7cb3042b9d1edf1058d5bcc7d2e044d
MD5 a9c57e5c4e1a26bfa9a3f98a82fa2306
SHA1 810e9bb363cc50b91576506aa1accd8a6e022abb
SHA512 26d6d102df747f1ee094ed5a7a99e959f193279e21f9d03eaff3c66e646bd81192aa9423eca0ff4565a4044b6858f155f53113d352699e97dad06b3d179779ea
SSDEEP 768:V5qQU/Oqy+1Qhm2Q1BaVbVfievgyiDw/i5E5/XuMZmwgCLWar1l:V5EOqy+1Qhm2Q1BsbVfi45KoXFZmGWS3
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
840	AcroRd32.exe
840	AcroRd32.exe
840	AcroRd32.exe
840	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1244	840	AcroRd32.exe	85
PID 840 wrote to memory of 1244	840	AcroRd32.exe	85
PID 840 wrote to memory of 1244	840	AcroRd32.exe	85
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 2352	1244	RdrCEF.exe	86
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87
PID 1244 wrote to memory of 3764	1244	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a9c57e5c4e1a26bfa9a3f98a82fa2306_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36B4016074683A378850C379AE1F77CC --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2352
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=27A23A2397AB9CE0FB78A3EBCC3A9160 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=27A23A2397AB9CE0FB78A3EBCC3A9160 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3764
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F57C799EF7E3CCE75E37BE1C0D5C6D49 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8A9C82454CDDDDA1A49646E1536A5B71 --mojo-platform-channel-handle=2424 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1492
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C0CF76FC4797AE45CD3E42A4B514B18E --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1112
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EABB7F7AB362C79EC9ED91CA4D4BB2FD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EABB7F7AB362C79EC9ED91CA4D4BB2FD --renderer-client-id=7 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 4192f2c2a90108837fea9edf1cbe9a2a04b5f97f711d492f585eb894d1a2fa3e
MD5 05723e5591fb86567fa53bd5df3694b4
SHA1 57d892226463b4d353c5a44a6b6efba0246d06c0
SHA512 5137635cf78f5e04520b6b91dc3ec26788988534fcaa10157ab28106895e3486d2a1423cfc01ab9d09b1f93a027819d89a6ca68a83dcfbf864c6e18da2e2de98
SSDEEP 384:yeMdThPstELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2s+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download