Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 23:24
Behavioral task
behavioral1
Sample
a8a4f81c649711558a42d54c0da429fd_JaffaCakes118.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a8a4f81c649711558a42d54c0da429fd_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
a8a4f81c649711558a42d54c0da429fd_JaffaCakes118.pdf
-
Size
12KB
-
MD5
a8a4f81c649711558a42d54c0da429fd
-
SHA1
c1fe5df8774cb6d1ae07e6affce1fb149f8c42a4
-
SHA256
568be8971a8b3410c38101c974e4529ce14930cbcb4e50f119ed25f9bce6b83a
-
SHA512
b64e01823c9b6ea96b65eedb7350540807a88b87fe8a6cde7334825cd8ef11b0ddad38a303c588f9ef3b65ee93e7617c6902f897c0399424f8ada075c96afed7
-
SSDEEP
384:bONbedw+lJ572Dkh/slNsbSKiiU+Ra47lq1iKwMFkAHrsUYi8mmmmmmmmmmmmmmH:UDkANs+cU+0iV78q
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2208 AcroRd32.exe 2208 AcroRd32.exe 2208 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a8a4f81c649711558a42d54c0da429fd_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2208