Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 23:59
Behavioral task
behavioral1
Sample
d0af89f80822989531882ebe2b55ec80_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d0af89f80822989531882ebe2b55ec80_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
d0af89f80822989531882ebe2b55ec80_JaffaCakes118.pdf
-
Size
12KB
-
MD5
d0af89f80822989531882ebe2b55ec80
-
SHA1
47cd5c36b76dfe5bc29adb2bfbfeec6016c2bb01
-
SHA256
83c73615f52dd159ed2cc18bfc8687ac4f0c9ea50ee449ecab5e0c54ba14357a
-
SHA512
d1d9cc669641392622e036ec3f8b7fa3dace868821042c6876b5f7585f556b16b74d9ada88880e74c7526a142d18c9fd0c75576c7f4f30120fb7e070fa9056ca
-
SSDEEP
384:bONbedw+lJ5Jpg+fqmBbmGXNArOA8qUbcYxzmGzr3:rnW8qUtmOb
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2284 2192 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2192 AcroRd32.exe 2192 AcroRd32.exe 2192 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2284 2192 AcroRd32.exe 30 PID 2192 wrote to memory of 2284 2192 AcroRd32.exe 30 PID 2192 wrote to memory of 2284 2192 AcroRd32.exe 30 PID 2192 wrote to memory of 2284 2192 AcroRd32.exe 30
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d0af89f80822989531882ebe2b55ec80_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 7522⤵
- Program crash
PID:2284
-