Analysis
-
max time kernel
140s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 05:54
Behavioral task
behavioral1
Sample
2c08581dfc2d58f7a50f8e80843cfaf9_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2c08581dfc2d58f7a50f8e80843cfaf9_JaffaCakes118.pdf
Resource
win10v2004-20241007-en
General
-
Target
2c08581dfc2d58f7a50f8e80843cfaf9_JaffaCakes118.pdf
-
Size
5KB
-
MD5
2c08581dfc2d58f7a50f8e80843cfaf9
-
SHA1
68a58238e052792e3d30d216d0dde559561df34a
-
SHA256
4259c04ca08d6cd66c2257f8974655a86d50c61e8999bd7dff1b4de57f5e16f4
-
SHA512
37b5524fc94d0ed5ccd62f43c111cc2c07a946b8e54784278aa9c69e8fc942eb22892ad458088f427697791cd8f3c37aeba9e9747b36a1815b263ae65785b1b7
-
SSDEEP
96:alLYdKDsoyaLC9dwyNdDpCT6NxSBESuk4vhFRINOiw9MSewKcfG2DXsfI1fLnfqm:alLCosoyaLC9CODY0xmkNoOrBfG2jsGT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4480 2872 AcroRd32.exe 86 PID 2872 wrote to memory of 4480 2872 AcroRd32.exe 86 PID 2872 wrote to memory of 4480 2872 AcroRd32.exe 86 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3152 4480 RdrCEF.exe 87 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88 PID 4480 wrote to memory of 3104 4480 RdrCEF.exe 88
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2c08581dfc2d58f7a50f8e80843cfaf9_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41F11458B9011EEECBF3B95DB587B8CC --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:3152
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F5B8570F0D53EB36887771CD4485C2AA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F5B8570F0D53EB36887771CD4485C2AA --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:13⤵
- System Location Discovery: System Language Discovery
PID:3104
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE08C4B5014D9F21DCD01799DED5350E --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:2564
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CFA8C1857E6C096183838CA1D55BA9C2 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C637F13BDC5777B7AD9AD7E94CE2CE54 --mojo-platform-channel-handle=2468 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:1720
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6042EDE02F4DE8B24B27FA329F8D4DE2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6042EDE02F4DE8B24B27FA329F8D4DE2 --renderer-client-id=8 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job /prefetch:13⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:440