Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 08:08
Behavioral task
behavioral1
Sample
855dc2ca35c229a369f72a52f0551d24_JaffaCakes118.pdf
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
855dc2ca35c229a369f72a52f0551d24_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
855dc2ca35c229a369f72a52f0551d24_JaffaCakes118.pdf
-
Size
16KB
-
MD5
855dc2ca35c229a369f72a52f0551d24
-
SHA1
fa88845104f0bc7ad6b3a011917d53ed3fb340c8
-
SHA256
669f641f4f424ebd0349b7ca7133f05da8a095ca6d28ea0ea71a924bcd481912
-
SHA512
ec9730a4d120cde5242b1af404117f6928930d6c25d6ede5d84d437b0029ea738ec8753b3f05c6a87d6e1d2c519069d97ab302e106be5f2d64c88748538eb099
-
SSDEEP
384:4ONyCeewIjJizxterzWEABHLB6CQp6w8qurLz6oXjeNAH165HgREv:0S
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2412 AcroRd32.exe 2412 AcroRd32.exe 2412 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\855dc2ca35c229a369f72a52f0551d24_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2412