6d5972782d509cfd820fcba5d4c104bd3bf9d9222e2edca042fe2af7e7906820

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a98af8efecb38a408c95b0c67a3ae18_JaffaCakes118.pdf
Size

41KB
MD5

8a98af8efecb38a408c95b0c67a3ae18
SHA1

3d614e83bdbca42d8ce127173996a662e72c9281
SHA256

6d5972782d509cfd820fcba5d4c104bd3bf9d9222e2edca042fe2af7e7906820
SHA512

bf477fe5b9eef0f5151a8a5e5059d021cd7b6400ff57449bcfd54c827b2cd0259695dfb23a79066a8746542ac4a8fd551bb9e28461aaa39031be9d77caf6232a
SSDEEP

768:0iPM80QuOMhQ8pwVTRWxuSRyzXXQVll5ZM92DBr3jbv8H6:HPMXZFhdggqzXAVllfM8DR3jbEH6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe
2756	AcroRd32.exe
2756	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8a98af8efecb38a408c95b0c67a3ae18_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a83e5b0840d486ee3ec91a2196d649b9

SHA1
1f49a0111164250aecc9e8f49dae286fd05fd8be

SHA256
a019906430f072a1836e49e0a4361a1d649fc0e391154b4555b6685f61e841e8

SHA512
5309ac44ed25055056e8ce64f142fc2cf303c9a5ed8b4d155697785a31dc6d41f352c12c8810878dda82ac744076873a671c13b47a98b3be6e4fed6b628c2b2c

Download Submit