Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 03:10
Behavioral task
behavioral1
Sample
b1e529c8fa8b6023703a22a9ae62456d_JaffaCakes118.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b1e529c8fa8b6023703a22a9ae62456d_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
b1e529c8fa8b6023703a22a9ae62456d_JaffaCakes118.pdf
-
Size
106KB
-
MD5
b1e529c8fa8b6023703a22a9ae62456d
-
SHA1
ed6ffc85013e6c779ea9b5d347b7fc4d01bedf18
-
SHA256
5fc7c5c95cdc8ceed8260912ac8fd8b99215a6422417d076f4ecc86ed4bcaa44
-
SHA512
c9d411bf56376bf6eafede74a8357d103c8c1eaf3859c59c6a2effcd1bbf8a442b74692047535c5696419fa04c11e998fd5915f266f157f1c92f53f96685dd0b
-
SSDEEP
384:bONbedw+lJ5o8vUT53v+QCzpCywT+CJrvmNyv45RXtCCWX8mrdPoEovPuZ2N86v/:Z
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1064 AcroRd32.exe 1064 AcroRd32.exe 1064 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b1e529c8fa8b6023703a22a9ae62456d_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1064