Analysis
-
max time kernel
93s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 00:22
Behavioral task
behavioral1
Sample
8845004a13a8a2b46a7ac94676741c0a_JaffaCakes118.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8845004a13a8a2b46a7ac94676741c0a_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
8845004a13a8a2b46a7ac94676741c0a_JaffaCakes118.pdf
-
Size
9KB
-
MD5
8845004a13a8a2b46a7ac94676741c0a
-
SHA1
6d367b99dfd682166a63ca5364d88c8789e20496
-
SHA256
4a550d864660a8cb2097de19284000d7dbcb5b9effa6ab753bfdbeb834124b1d
-
SHA512
251112cced213ddee7dc1788bc36bdd497806d8f61ec69e6cc2db7b77e7d65db0e9db8aadc6329849c4545b21adbfd7ce04c92c9a51f1113c7e464c4f04b75b6
-
SSDEEP
192:KPz4ULMxLIKXHsfyxuiiBx9WHGQmvr7xhRozYsMLlMCFQL+WEreMikFAUyYRge2s:KPz4ULMxLIKXHsfCa/QKxhSzoFQL+2kr
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2224 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2224 AcroRd32.exe 2224 AcroRd32.exe 2224 AcroRd32.exe 2224 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8845004a13a8a2b46a7ac94676741c0a_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e5f2d17e3793702c172509d911d3ae0e
SHA13fe8719f3e5f1f809b180ba14bc180769cfc26bf
SHA2566f29e83acb189a900dd2fd03ca96fd93861fd74eedac6277560d082b7ae36a8a
SHA512365cd38b6187771423d2b39c57fb755d34ba6864ab47888a39901cbd22483df932fbaaf26ddcc936c2f4e9fc14325ffd0810530e023880f449f763d36e03d45f