159aee2c2abaf4ff82c587d0bd7ba1c0aa1d40ac585c8f2fe9714a0e0268b01e

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23f28579f6f610160c4f5005445dc940_JaffaCakes118.pdf
Size 8KB
Sample240704-adh2latbnp
SHA256 159aee2c2abaf4ff82c587d0bd7ba1c0aa1d40ac585c8f2fe9714a0e0268b01e
MD5 23f28579f6f610160c4f5005445dc940
SHA1 651a57398b1aedda80916147a412f48e9058843a
SHA512 84c802e5f65b3d26a8359b78fc51aeab74f5aa55debacab2f7a2042cd0e8ce8a7eaab6e9fb80936bb8be55887b90fb6e97d61d32b089f19652eae87674486b52
SSDEEP 192:QP5uUakq9yvO9k6UOBz7CaRGBZc9Y9RhxgSwiy2sUZqs+tNOIyQBYV:QP5udkq98O9PGrZciwN2scqBtNKuYV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4612	AcroRd32.exe
4612	AcroRd32.exe
4612	AcroRd32.exe
4612	AcroRd32.exe
4612	AcroRd32.exe
4612	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2064	4612	AcroRd32.exe	81
PID 4612 wrote to memory of 2064	4612	AcroRd32.exe	81
PID 4612 wrote to memory of 2064	4612	AcroRd32.exe	81
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 3428	2064	RdrCEF.exe	82
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83
PID 2064 wrote to memory of 4508	2064	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\23f28579f6f610160c4f5005445dc940_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0D0315EFB630C8A103A3944A67998956 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3428
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D28516DD599D25A8716E168A77234583 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D28516DD599D25A8716E168A77234583 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E88DBB93BC1F67CAD54CC706AE45AF99 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=752EFE3EA089B04D931CA35938790247 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=752EFE3EA089B04D931CA35938790247 --renderer-client-id=5 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6FCF852A37952B965E4CC1E30A909657 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:208
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E0E1E988088C1A21D578A13DFD7A3549 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 18a873cd24998e03affdc265f87398fa2206fe18c69a17e33c8cc40ea80419dd
MD5 dc5b6d3eca6f7fdcba41c7fbdf66f1b6
SHA1 4d2b1419f04614531b641d3164add51ee7949bb7
SHA512 5d5ea750868570a2ed7ea53fa38408e6beff6ed66e88e4e81e7b818e94149a694c7fc1342dbb7b0cd2837c2c9fa83450fd48ac449c029e931fe95a58c515d25f
SSDEEP 384:yeMdThPntELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2n+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download