Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 06:27
Behavioral task
behavioral1
Sample
dbfb070d7a58552efda18010504c6ce5_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dbfb070d7a58552efda18010504c6ce5_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
dbfb070d7a58552efda18010504c6ce5_JaffaCakes118.pdf
-
Size
16KB
-
MD5
dbfb070d7a58552efda18010504c6ce5
-
SHA1
36f0b19793f805f8fcebce37c3668cadb509feab
-
SHA256
07c6fbc5cf2b8df98c9b4c360e7cf15f2721d0fbe056b5357fef501c84d0d19e
-
SHA512
13062e135815e5c8f92c5c0f659a80262917fff703b7adfdc50fd616a0a2cf2cc753a492e8ce6b3363cf715760bcc89f31ec6c149f4237eeceb3aebbd277d085
-
SSDEEP
384:4ONyCeewIjJizaTqNhCkL2u7C+zp6Q9qa7KEv:H/S
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2528 AcroRd32.exe 2528 AcroRd32.exe 2528 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dbfb070d7a58552efda18010504c6ce5_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2528