Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 06:56
Behavioral task
behavioral1
Sample
c0302bf38756cb77f98501cc49537356_JaffaCakes118.pdf
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c0302bf38756cb77f98501cc49537356_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
c0302bf38756cb77f98501cc49537356_JaffaCakes118.pdf
-
Size
82KB
-
MD5
c0302bf38756cb77f98501cc49537356
-
SHA1
6aa29571640c8fbfb1f4d6ccb9a1e05d180ea166
-
SHA256
bc849e7739d1743a7080d66990bba2ef145ef9d5feb5bb236fbfd90e60f8c4c2
-
SHA512
8963e3166c7672b3419d5fbb25c8d3515c7346abe4f64dee83c05ca746cd802b156e0664969f29f8859ce9f6e515a466869ff5eb4ddf895ff53434c01477729e
-
SSDEEP
1536:Y5LzPOaFcinpRTE6kIKEG/ajLMrFaSr4mXBq+wPNWlKfpBvRRWApO6QGxYT:spFjvTE6HbiMMrFPdA+wPZfpBZY6G
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2688 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2688 AcroRd32.exe 2688 AcroRd32.exe 2688 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c0302bf38756cb77f98501cc49537356_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c3700bb0646febe2ae48fbbabcb1cb3a
SHA15312b7aca6d19faa962d4681cad4c20519c7243b
SHA256be8fbc5e83101a76b9d77273185e968e01d8d02e5675a1328f9d5cdcdac72047
SHA512f1c16b67f99d6175b96a9e2b01cf16cc81aaa990deadb35fdb446a37cc897b36042bdc642b86da0b5cc32809a9bd449f78e59736b551ee889ea84d5bb7ccfc35