7a8ee0492771a2178402a242ac09aa2557b776477776051a1e8ce487ca6c4091

Analysis

max time kernel
141s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1fe83fa3b251f286406e25437337fc6a_JaffaCakes118.pdf
Size 9KB
Sample240702-tb41tsthjk
SHA256 7a8ee0492771a2178402a242ac09aa2557b776477776051a1e8ce487ca6c4091
MD5 1fe83fa3b251f286406e25437337fc6a
SHA1 2626b1e5f4117f95db44ea4e22a3d442eec58262
SHA512 1d8c99a33b62b1b62f9025dece364e9bd79905b6cac63bdb8abe0b0173956d3c3d6997ee9da227e91c415b90816893473c50ca20f2e2caceac7cce899697166d
SSDEEP 192:IPz4ULMxLIKXHsfyxyB6OOv9w9BW6OdPNhzG1XlUn82l8HR1k1Dd7YkxrZLDwFk5:IPz4ULMxLIKXHsfCysO+JtDKu6R1WBTD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe
1260	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1948	1260	AcroRd32.exe	81
PID 1260 wrote to memory of 1948	1260	AcroRd32.exe	81
PID 1260 wrote to memory of 1948	1260	AcroRd32.exe	81
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 1632	1948	RdrCEF.exe	82
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83
PID 1948 wrote to memory of 3276	1948	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1fe83fa3b251f286406e25437337fc6a_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C7D73161196DE931B5E20204EEAF98D --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1632
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7B7FEDD9CC406717DE57E4F6CE51401D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7B7FEDD9CC406717DE57E4F6CE51401D --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0605E53DF48B1BAF2CC356EB0C968C3A --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3128
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AF723D4BE38878F891D37A5FA7A82832 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3176
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4617F4F887E4FCF5C957E646379EFD3A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4617F4F887E4FCF5C957E646379EFD3A --renderer-client-id=6 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4222BFA88548B8AE495BC42F6D16F107 --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 1247e3b68f3660de951d7b24b033cd76204f8704b1491fb4f1d2a6a7b2c38343
MD5 fce20a127125ce1b83b65470c885c82b
SHA1 35e367018a88f64f0c1087762769bd5c11430122
SHA512 024f3377a57d06483420de0537d06825571a987fb406fbdcbc3c9c464aba7636f9c85cbe7f55bafc105f8f48d523c1eebd16ebfe01b80420bed67f42541c016c
SSDEEP 384:yeMdThPytELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2y+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 5b2b6801f570bcb76abee0ea2dc5553c25a7945012da7c08a2a12a09ab48122b
MD5 4a1254fe4a1bca9ec64afdf86039ac77
SHA1 4cf4dcf66b53534eb128ac01d5c93b38da07dea1
SHA512 27d05d863d233a3c33179ce936edf3957fd92a6bd55d5d0f8993f9d9ab56c167e66c1354a24d77186f357e0049a6fce5be836aa7f25add28cfce1a65cd02839a
SSDEEP 384:ieBdThPytELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:Vy+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download