6bec50feeb6e7d01a1f882adf55c2df6d979d58c528b10164a4c2ab900bc8231

Analysis

max time kernel
141s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09058a892cb4e7ecdf0ed3e854d0ab99_JaffaCakes118.pdf
Size 9KB
Sample240624-rn5f1swfkf
SHA256 6bec50feeb6e7d01a1f882adf55c2df6d979d58c528b10164a4c2ab900bc8231
MD5 09058a892cb4e7ecdf0ed3e854d0ab99
SHA1 2cdb209e46342a7235a3d6bbad384d9a643da4ef
SHA512 d3b615f58e2a6f54e2175a07fb34d1ed7042fb602a7716fe01c62c038fa5e4ead24b602f4221dcc41c64a4270b83fbbe55c8c12c16906c58c0987dcd9f121e3d
SSDEEP 192:gPz4ULMxLIKXHszsbcI7DqSm8how88ARl++D3vYk1kkAtnhegjEU+2pmXuwH6kCj:gPz4ULMxLIKXHsAbwyhoaARl5w3kwnj/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe
1596	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1652	1596	AcroRd32.exe	81
PID 1596 wrote to memory of 1652	1596	AcroRd32.exe	81
PID 1596 wrote to memory of 1652	1596	AcroRd32.exe	81
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 1064	1652	RdrCEF.exe	82
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83
PID 1652 wrote to memory of 4308	1652	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\09058a892cb4e7ecdf0ed3e854d0ab99_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=570696159B1675D2670306F1AF34E0A9 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=272582F25BFA59892FD8AF12AEEE8994 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=272582F25BFA59892FD8AF12AEEE8994 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=75C173D9C86E4E14961655E3527BE13D --mojo-platform-channel-handle=1808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1900
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9C055B0C033620A743832E7B3C4A8E5B --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4296
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A3906C4240AEE653EF0B4EF50F3326DA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A3906C4240AEE653EF0B4EF50F3326DA --renderer-client-id=6 --mojo-platform-channel-handle=1920 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3176
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=99CC036CB18B7ECC8FA76145048F06A3 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 4590f21da37aca05f289bda2af00e359b60066fad855584b2c82dd4514218fb0
MD5 3f17ca83e78945b645ea42acdab9987c
SHA1 f1c9d2df01c3c87aac56bab9f10d6fc621e2a3a1
SHA512 152355e918584d342207dafeeb2104b8e5c101cc7bbb3792e57864c840e8fff94832d9a4a18436b47561a0bfb2adc594e3fe8e6dc1df350724864cb1774eda62
SSDEEP 384:yeMdThP2tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:22+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1596-33-0x000000000A180000-0x000000000A1A1000-memory.dmp

Download