Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 09:06
Behavioral task
behavioral1
Sample
1ab4dc515b795db66ff8d92a667a35d5_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ab4dc515b795db66ff8d92a667a35d5_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
1ab4dc515b795db66ff8d92a667a35d5_JaffaCakes118.pdf
-
Size
72KB
-
MD5
1ab4dc515b795db66ff8d92a667a35d5
-
SHA1
aa0a18a3d24e3b13e932740b23145e9d192e35e7
-
SHA256
9d3c5e2785702f000fa22664d95951eb14ab016c2c4f5c249a1c1738ec211806
-
SHA512
848383f4e02d0625b41643024db1dad4ab6f6c73bc98c497de0982f7bbf416f1d1c520b5a4dc953aac33fe96164e39932726bf6386e8fd500de3ad3d76e2634e
-
SSDEEP
1536:Fgzny1ycP65fwPqKARjS+fWXlaJ7AjT7ghzwnVhaY:YyscPiwwE+OXlaFAzghzwnVv
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3900 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 3900 AcroRd32.exe 3900 AcroRd32.exe 3900 AcroRd32.exe 3900 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3900 wrote to memory of 4028 3900 AcroRd32.exe RdrCEF.exe PID 3900 wrote to memory of 4028 3900 AcroRd32.exe RdrCEF.exe PID 3900 wrote to memory of 4028 3900 AcroRd32.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 1524 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe PID 4028 wrote to memory of 3572 4028 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1ab4dc515b795db66ff8d92a667a35d5_JaffaCakes118.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BDA3D78B714256939A2D9C16773D3B7D --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0707C028E6D23017C086BAA644FFA178 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0707C028E6D23017C086BAA644FFA178 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D75F2AAF442F336DC68D24E35E8EF023 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0327F2B142D8D34160145BDAE9F7B04C --mojo-platform-channel-handle=1900 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=30BE4750371280CE65379D69A9A3D959 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=561A3405E9B40FBF1C946C9E634BDEDE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=561A3405E9B40FBF1C946C9E634BDEDE --renderer-client-id=7 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job /prefetch:13⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD55fd75933c3be96ca49badc38dbfd0a44
SHA1ff9bd1af7b5f19865dc9e1b8d82374b2c87cef49
SHA256d6d6dbc65fb76008060fcf436ac247a0ab09aac7bf4f8fc808624ba39d51bb5c
SHA51228a8d29fbc78aced5b0afe1fa0446e557eea9f3d9ced048181ec498fa634c97e1f82dc3cc0bcdd38f10af2185f76f26838483871521daa439d5879bc6ec776d4
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD597d1dbc3cc5ec769b665f94b5fb6dd6c
SHA15ff213e04e3aad407563d2e5fd2171c24cb119a9
SHA25647e31cc29bdefe4d54a9db9f07c8dd51cd50228c704608fe518825ef4f8dd798
SHA5127667578e7a9cc78db59781cb4cf029bc5822aec2eeaeb0b3d821efe7f6ae71aaadb4a53658d8cff71481f65a91fbaa9917bd5d887c6e32dd54e2d8709bd9e6f1