Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 15:37
Behavioral task
behavioral1
Sample
bc56ac87eaba5438a84fb48fa3b1b8a5_JaffaCakes118.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc56ac87eaba5438a84fb48fa3b1b8a5_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
bc56ac87eaba5438a84fb48fa3b1b8a5_JaffaCakes118.pdf
-
Size
48KB
-
MD5
bc56ac87eaba5438a84fb48fa3b1b8a5
-
SHA1
87391127c64e4566d962c88996adcf5845054ce0
-
SHA256
35e98a7980d75fe0ebe1e0607fd3fc476e90d3e3868c4aede6dac433223759e4
-
SHA512
ed8333739bf6c834a2b4984547b7cd5a0a915c5133d6606005e972583743389e01c6c922aa485ff59e475b180e378b70f9b8f5d0c9e506b8eddb4023ba03acfd
-
SSDEEP
768:JgGzpDEqsA1NU98T7ZhZjZPPi+3Psnhp4caP8+MHzGFR:qGF4IZjZPPF3Pcp3aP83HCFR
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1940 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1940 AcroRd32.exe 1940 AcroRd32.exe 1940 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bc56ac87eaba5438a84fb48fa3b1b8a5_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bd2dd740e1b4037fc6f8d8445d4ebd45
SHA1fe81f917a622bd37090290c59d23ef934ed7071c
SHA25616f5d84f70887602cf4ee10411af166b04e7b272fd8cbb9500a47f247022a647
SHA512cc2d7e18efbc67d9e20cb180eede2f58473dcb1e2e0a1d1c3ef7880f46e23b52308d9278239825fdea69916cd65dd42582d40ec5106c5e2877e968df79cc49c8