9ebec46a85fe0a82c05f269c7231b99c5d4eeb93077d6051f0c33a24c318bb62

Analysis

max time kernel
94s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

18ce5ab6080b06b11c1f201ad6695a1b_JaffaCakes118.pdf
Size

84KB
MD5

18ce5ab6080b06b11c1f201ad6695a1b
SHA1

0b00af555f38f1077c15460d07f60db4dbffb4ed
SHA256

9ebec46a85fe0a82c05f269c7231b99c5d4eeb93077d6051f0c33a24c318bb62
SHA512

3f0a700fe19df750581d4201dd31ca02170a038d4eddfc3dbb9aba91306699f3d0d80c55092047e8d480f496dcfb8d8362a2613d9b36d5ae2aa3546721e9b82e
SSDEEP

1536:aK+NwsdZVMOjvo+IM/LAu3LQpenQMhVdKhVUOB5QM6vQS+WOpOwrgIbW4RpANBby:sZVMOvjIM7331hVdKcGutFTwrgIdAz3C

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4532	AcroRd32.exe
4532	AcroRd32.exe
4532	AcroRd32.exe
4532	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1076	4532	AcroRd32.exe	85
PID 4532 wrote to memory of 1076	4532	AcroRd32.exe	85
PID 4532 wrote to memory of 1076	4532	AcroRd32.exe	85
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 3368	1076	RdrCEF.exe	86
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87
PID 1076 wrote to memory of 1736	1076	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\18ce5ab6080b06b11c1f201ad6695a1b_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=69EF66FCDF20007DC270B14E64577CB3 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=032DC902C88A50396E99B7D1E868BA68 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=032DC902C88A50396E99B7D1E868BA68 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2CB0274F9D7A9502F4B568F85086A03E --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3016
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=575F2EC11A5951AF372250462BAF4765 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:224
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B720DB55A5C32B1D65E22347BCF2EADA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B720DB55A5C32B1D65E22347BCF2EADA --renderer-client-id=6 --mojo-platform-channel-handle=2532 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=46E7FA22F5DDB100CD87A0F7297AD946 --mojo-platform-channel-handle=2108 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a3df03b037d004554b4f27775597e820

SHA1
09c0e6eaed05a062f2c0ca420f6f166d5349a71b

SHA256
60205b63e96dfcb6e463e16afb3a7a56d4c78b449737d4ec2b4d411a554e47f4

SHA512
1a97dfe8a8fa7a84a3b6b3d6387545d8ce83f3aaa98fbf3f41ebf12b0ee13712a0da589b035a6104de9894185893e11de62dc36573a6a38d942330e9ed313f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
0efbb48ac58ddce85006a88122660ed8

SHA1
22e7ae797f016eeb2337df099cbc0b88f862e842

SHA256
8c0f13ba47796fea5e3708ca65b5e9718a232dfe5081b652d2f2acecf78ed8ce

SHA512
fd13cf43b124fb1bc58f494a5180a6a2b8e629a8e46d82c019fcadfd11aca214f53cafee58b70b2309c82d3161a1a91037daf6d28bc584e318d86126b6315f35

Download Submit