Analysis
-
max time kernel
142s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 06:08
Behavioral task
behavioral1
Sample
ad1d2a18525165c677ac64f997713cb4_JaffaCakes118.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ad1d2a18525165c677ac64f997713cb4_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
ad1d2a18525165c677ac64f997713cb4_JaffaCakes118.pdf
-
Size
34KB
-
MD5
ad1d2a18525165c677ac64f997713cb4
-
SHA1
0748229a440cdc8a8868293b5c3075258aef8e65
-
SHA256
7bd4dda3f499018d01435d55a51559bfb1171746bdf1a16e843389ec78ed8efe
-
SHA512
cfdc2a976b7be264ef2b7b1007e6f906f6fc81ad700d06cd233fdbfd1cfa2f9d43a135def1620f0aefa0f90508d4f3c4097892ad7eff0480eb6ccb1bf7276577
-
SSDEEP
768:lXuMZmwgCLWarHE5Hpxf39oJuFQmxUKiimt:lXFZmGWSwjf39oJuwimt
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 AcroRd32.exe 2120 AcroRd32.exe 2120 AcroRd32.exe 2120 AcroRd32.exe 2120 AcroRd32.exe 2120 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 3852 2120 AcroRd32.exe 85 PID 2120 wrote to memory of 3852 2120 AcroRd32.exe 85 PID 2120 wrote to memory of 3852 2120 AcroRd32.exe 85 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 4420 3852 RdrCEF.exe 86 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87 PID 3852 wrote to memory of 2160 3852 RdrCEF.exe 87
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ad1d2a18525165c677ac64f997713cb4_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40425FB93086EA5DC6FBEEE7381F46B1 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4420
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E6D462C66F9C8A51AC317010944CFA61 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E6D462C66F9C8A51AC317010944CFA61 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:13⤵PID:2160
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3D8EA7C649B1E5C6A228C5F11F6797B3 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2644
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0B2191DF466917377631D30E7017D316 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0B2191DF466917377631D30E7017D316 --renderer-client-id=5 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job /prefetch:13⤵PID:3912
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=51B96B85F1A7586EFF26FCD039BE1064 --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3488
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C1754B9B4FCEB5B959B9F125B3E0EAA2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C1754B9B4FCEB5B959B9F125B3E0EAA2 --renderer-client-id=7 --mojo-platform-channel-handle=2344 --allow-no-sandbox-job /prefetch:13⤵PID:1520
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3BC32AB353E33E914C727B51567E8674 --mojo-platform-channel-handle=2940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1532
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD526a18cdef4abe4b7b60294ef428270c8
SHA1406f6c1a287084dc65e841344fad5fa34745c01e
SHA256f12906b0418ea85fb067a181f5a9bf87230eb080c1038e752a0c04869a21ad1e
SHA512139d436f3d527b376299f94a4ba75665a727fca6655d09cde36e80ad5bc6807befd20402b7c6c863b6edc05ec17744cd49b91f6c573773b5bdd7dc2092550f65