5fef381acafe975bcaf8f74c37987ae1215e84a33b815408224a47090b75d646

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
248a049b52e79fe4046a66d53d59c00b_JaffaCakes118.pdf
Size 7KB
Sample240704-efxpzstakn
SHA256 5fef381acafe975bcaf8f74c37987ae1215e84a33b815408224a47090b75d646
MD5 248a049b52e79fe4046a66d53d59c00b
SHA1 cf36570d027e7813be3febe12f168647d93f7d25
SHA512 bc3c6bc027ee1e7ad948fffdb86d6e3757ac7a7ad7a125e840fe64d5945ff29e2aa28a991ca170b86488e2ad4a0480d8e319ca0438d49ae5c54b23a9736f114a
SSDEEP 192:LP5uFm4kliWijQXepai3pNqa7gpwQ4lCNL6BJfiZAtKVueSJePJYF:LP5uFm4kAWLNih7gxb6BJfiWt7gJYF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3204	4628	AcroRd32.exe	81
PID 4628 wrote to memory of 3204	4628	AcroRd32.exe	81
PID 4628 wrote to memory of 3204	4628	AcroRd32.exe	81
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 116	3204	RdrCEF.exe	82
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83
PID 3204 wrote to memory of 1320	3204	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\248a049b52e79fe4046a66d53d59c00b_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D3A4D9754D454FA7EF3753E25041FB53 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:116
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2DF30ABB8213836EBED46407B4E16DAF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2DF30ABB8213836EBED46407B4E16DAF --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1320
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FA670C149B93012559F82E54A5DF0402 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4008
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ED8AA06E658E4948750100F9434DD3FC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ED8AA06E658E4948750100F9434DD3FC --renderer-client-id=5 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3132
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=53EDA22D630BB0E070E74F1678B54896 --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3372
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6361A0A4FE98EF1B3C9008BB2B82F16E --mojo-platform-channel-handle=2380 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 970336f775d22be176ad90728726f876addde39ded419eeebdf5069508282d9c
MD5 b8537671b0ec542e6e6c9c4d660ea70b
SHA1 6eef4a879565576e2a9d3cdfac1f7f23ca4f042c
SHA512 9367bb6fcc11e86ee129b9d0cc8bb4095a2143cc349c5840c600af45b93268e7ee96a12086876937a6e36de94e461bd5027427e3270aab86f59848fccab8ba41
SSDEEP 384:yeMdThPItELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2I+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download