Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 04:35
Behavioral task
behavioral1
Sample
a99b5ccb90ddb467cf6154c4bec68458_JaffaCakes118.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a99b5ccb90ddb467cf6154c4bec68458_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
a99b5ccb90ddb467cf6154c4bec68458_JaffaCakes118.pdf
-
Size
87KB
-
MD5
a99b5ccb90ddb467cf6154c4bec68458
-
SHA1
6ae1af12e56c86891d8defa65b7bc08415ec6514
-
SHA256
cf1ea465bdf4523a731b2bb1d643b6718eb79c14572d36c6cd838fd366dc3716
-
SHA512
5d80ff8ecd9aa2592ce72ba5fccdbc3de782780f68c2d7db230b8179e3c682f2ab0cf9710e6f653086295a5c888e15cd17fca803dc4758085194d3c9fa96826e
-
SSDEEP
1536:5S5ofQfmbsccPHGe0MzSq8IuaXmVkbTm3QzgeLNcUW8pOGEWzokX1O7ITTJTJQYd:cGwM5Mf2q/uaXmVkOQzgeLOHG/okIMTF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2500 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2500 AcroRd32.exe 2500 AcroRd32.exe 2500 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a99b5ccb90ddb467cf6154c4bec68458_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57fec41018eb4b1d4c7a4fdc4a9612949
SHA1e109373af83f5750c59a731c69f241f424c26bba
SHA256899e85fa28d8f8a206b7c252a4c8058054eff372c2f30fa5e043ebb81ea1ac21
SHA5125622766b5936076624ed3c81b6c3c3d0cb48273ca59a18c562a3a9085bab09e53b767e74d9259c8e3bfdb975b7c8e9fc7b6afad3e4ec19518d82cd9c87eff21b