2b7aad44ec5de0714e1367501a17c86048a3fc36e5fd6d0f82f83520c7fb4c8b

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d7bd64df005565dece035d6d5e0a4a7_JaffaCakes118.pdf
Size

12KB
MD5

0d7bd64df005565dece035d6d5e0a4a7
SHA1

2ef81745a4f2730ad44b7703ca686acbd38533d9
SHA256

2b7aad44ec5de0714e1367501a17c86048a3fc36e5fd6d0f82f83520c7fb4c8b
SHA512

8bd69a1b931da06d48d3e65d9291972af452e7df2dd49994c235c2362221dc62084becb0f1a770fb4c0b375052a5ed938eaef552d430ad7ec1a7f877708d3559
SSDEEP

192:bONbedw+lJ5F9cQna7oZ4X8rgeII11vPUfLK9nXu3:bONbedw+lJ5F99n+o5G3

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	AcroRd32.exe
3020	AcroRd32.exe
3020	AcroRd32.exe
3020	AcroRd32.exe
3020	AcroRd32.exe
3020	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1564	3020	AcroRd32.exe	80
PID 3020 wrote to memory of 1564	3020	AcroRd32.exe	80
PID 3020 wrote to memory of 1564	3020	AcroRd32.exe	80
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 3360	1564	RdrCEF.exe	81
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82
PID 1564 wrote to memory of 2876	1564	RdrCEF.exe	82

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d7bd64df005565dece035d6d5e0a4a7_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=660AC084734ECA4C49CEEE368E78EC9B --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3360
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1AE106BC9517D3613CC8343C774051C8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1AE106BC9517D3613CC8343C774051C8 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2876
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35C15BE390B90E06C3E72EB8457F6205 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=702F15CBA9D4B8D4DAFD0FAB920395F4 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3432
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A89B9427543EA0ED269B690EC509D357 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=85A223B9ED734E8B91396A3D69184F53 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=85A223B9ED734E8B91396A3D69184F53 --renderer-client-id=7 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
2ae2b759cd4725ef8d493fc497a5dcd9

SHA1
d9c1a0249b6f24be5e338c33fb77b46b205e2363

SHA256
a5c6d0234914956902108a0b45001efc85fa5a3c99a8ff89a2ba2bdc39ac69bc

SHA512
bf8eb605a5c39a15c1dfd40f6c8c41b653a1faa3bce8d5cca3c8b630f9cc7997c8474b04747e9177dd6a056ba6b122681a7959150302d3137a19fa0a88b88886

Download Submit