Analysis
-
max time kernel
11s -
max time network
15s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 11:17
Behavioral task
behavioral1
Sample
dc3b0d429e89e220e6429b110cf34a74_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc3b0d429e89e220e6429b110cf34a74_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
dc3b0d429e89e220e6429b110cf34a74_JaffaCakes118.pdf
-
Size
12KB
-
MD5
dc3b0d429e89e220e6429b110cf34a74
-
SHA1
c03ecb8d99491a11cc3a2a49f45b3aedd0495dfd
-
SHA256
8eb61539a4a0c49200ddf0adf5cc834074f236dfef5e3683d5ee5570adc26468
-
SHA512
b594878568b916ebbc8935947001ad7aa6bd75459d511fc9f65ec226749ece21db4bb9b8cc96b7bb0e7516b381cbd385849bdbd2c59dc45cf55a305708c090af
-
SSDEEP
384:bONbedw+lJ5PLPeJiyD7ORtOuQqJvo2Lp0V3:hL9q7ODOuQqJvo2Le
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1120 AcroRd32.exe 1120 AcroRd32.exe 1120 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dc3b0d429e89e220e6429b110cf34a74_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1120