0cb02b64673a46e30df951bfc5514a0285e9b23be4ca4c75883ce7d427b11dae

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
186584c843aefba572b68316cb1aad37_JaffaCakes118.pdf
Size 24KB
Sample240628-cg52msvgpe
SHA256 0cb02b64673a46e30df951bfc5514a0285e9b23be4ca4c75883ce7d427b11dae
MD5 186584c843aefba572b68316cb1aad37
SHA1 e7f3a1fbc03eec68d553083670754bdc746024a8
SHA512 3f8b8e80be2d0c9915b87a8caadc94f694c73949239acf21fa188c4555f76f98992a2a72a156d1cf6ad00c484b689706267c7301ae715bf539b33254b60f7b40
SSDEEP 96:WEDsNyvV0c645vFB+OlybcxMFizBQoFMFizBQoS3KrOLJnVDceQj2KnSnZ1WjnYy:WysNAbl6y4yIYy5yqxbAA49NP4X+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3012	4256	AcroRd32.exe	81
PID 4256 wrote to memory of 3012	4256	AcroRd32.exe	81
PID 4256 wrote to memory of 3012	4256	AcroRd32.exe	81
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 1056	3012	RdrCEF.exe	82
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83
PID 3012 wrote to memory of 4604	3012	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\186584c843aefba572b68316cb1aad37_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A508EB512083D779E8D10C288903CADE --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1056
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ED07824573B933A8A77BED87B6E5E9AF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ED07824573B933A8A77BED87B6E5E9AF --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FB36E6EFAD13D60A5476760B2819E9A9 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2392
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0B89D77FA8615EC7F0858BEE778BD1B5 --mojo-platform-channel-handle=2424 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2108
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C1FB482154619196120DD8D9F5468107 --mojo-platform-channel-handle=1892 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4440
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B132B254250A15C6441A7F694ED0263A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B132B254250A15C6441A7F694ED0263A --renderer-client-id=7 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 a19306e0dedfed5a157d439753d2b4e7905b860ee74d7e82df0e3e58d6141469
MD5 83187d3a7768f21642748ed5b70b6a8d
SHA1 7c3cefc8de7919188c3c54144e211275c46d6e5b
SHA512 dccf0d090e94bb22701a66906a6eee07319d49c8b5f43a763c64a9af4dbfff416822ed1b552977061d21aed31f137e7777d791bf2a31ce164fdd85656ceeb19b
SSDEEP 384:yeLdThP4tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:j4+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 64bb8d4fc4e10ffd89a981316699b8bfd1b2cf185ff9a28173f2a3f5c2811d50
MD5 0191139e9f2960f1a0f00d181440e864
SHA1 b4827243b44d502909ffadd66bb0be7cbaafcb1f
SHA512 9f7f5fcec5600679f04cc3d896c273ce660e841ddd8509a6982a6d8ca1711cf19da3be03fe0b8474d6552a42d60377b759da020de7484d1d02ba8ac85d54639d
SSDEEP 384:iezdThP4tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:z4+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4256-36-0x000000000A7D0000-0x000000000A7F1000-memory.dmp

Download