1ce8b0cd21a6a02de160e4cd6daca87e098e9c1ec3efadcbf20c8fa46541c366

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 15:34

Target

74a621e5cbe09630bd6817b27e86fac1_JaffaCakes118.pdf
Size

102KB
MD5

74a621e5cbe09630bd6817b27e86fac1
SHA1

d97135931bb0fa443484aff6bf2daa4b0f424bd3
SHA256

1ce8b0cd21a6a02de160e4cd6daca87e098e9c1ec3efadcbf20c8fa46541c366
SHA512

9b31bd13ed7ee4e82e8ce1246b92280b374b7af9a9cdb98fd1d11d4426cfcb268452c49c45ef6d1e180c2612c2d2453de07d317c989cc7d11587bfb20ef18a65
SSDEEP

384:bONbedw+lJ5zHg90b7yNbmKS7TSImXOzQ//WfbzTxGqLiXQsAy8zmIKfXlpGnk9/:4

Score

3^/10

discovery

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2120 2652 WerFault.exe AcroRd32.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2652 AcroRd32.exe
2652 AcroRd32.exe
2652 AcroRd32.exe

pid	pid_target	process	target process
2120	2652	WerFault.exe	AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

AcroRd32.exe

description	pid	process	target process
PID 2652 wrote to memory of 2120	2652	AcroRd32.exe	WerFault.exe
PID 2652 wrote to memory of 2120	2652	AcroRd32.exe	WerFault.exe
PID 2652 wrote to memory of 2120	2652	AcroRd32.exe	WerFault.exe
PID 2652 wrote to memory of 2120	2652	AcroRd32.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 752
2⤵
- Program crash
PID:2120

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2652-0-0x0000000002E20000-0x0000000002E96000-memory.dmp

Filesize
472KB

Download