Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-09-2024 05:18
Behavioral task
behavioral1
Sample
e1c5cc23efdd6de1c93e75fc2d05d2a1_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1c5cc23efdd6de1c93e75fc2d05d2a1_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
e1c5cc23efdd6de1c93e75fc2d05d2a1_JaffaCakes118.pdf
-
Size
46KB
-
MD5
e1c5cc23efdd6de1c93e75fc2d05d2a1
-
SHA1
259d02c711744efce8d1b7971848e35e560ff2b6
-
SHA256
5dee4b9e7bd025b0235bac3289ac563be675cf7346a60c0be7d0bb57c1ece9ae
-
SHA512
00f65047caff0940337c4efddd4f6863424f5f6c61de1a12c9ce6174a57f7fd8cdd72e5de81f262bf1f956f23a82a5c7f4f111952fdb9d68b045164d9ca95134
-
SSDEEP
768:sgGzpD+p/NRGMDIhgYQHspX/wKeDLNxRC+eerqWpAHwPFm9975FXI4eg00zi0767:pGFSpZzMpoKcRCTuF875F4446mVEq
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2348 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2348 AcroRd32.exe 2348 AcroRd32.exe 2348 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e1c5cc23efdd6de1c93e75fc2d05d2a1_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ab5eab270c0983f0bc37e699da12d20a
SHA10a1e589e73fb779c8b1b8a557c66dcc9e5fea892
SHA25650a73fc27f781a2057bf3c1d91d80d4ba606a893a929feb644d9bb27b9657947
SHA512b7f0f43d4532ef1a52c387a0152e534d7611e9f7f92f9ab8cbcc82f9664758a163df0651cc8bda8899524b1d2d43ebda51c79eb543f109a129bb146c7210c64b