0a1d38bb360986bd563cc5ccf3fe16c3a3ff1c3824c8c1a501ef08ba75364060

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf574b108e5c84aed54a9e6386f7bfd1_JaffaCakes118.pdf
Size

35KB
MD5

cf574b108e5c84aed54a9e6386f7bfd1
SHA1

3967c111550a8dd01daca1b187433a03415532ae
SHA256

0a1d38bb360986bd563cc5ccf3fe16c3a3ff1c3824c8c1a501ef08ba75364060
SHA512

6fc1ed7904acb7a1dd39c6e38a103cc73ff3cf99337ee88fefc63e9784ba9130e95e26e09a8e6867974a788b78ec3377720cf1c18469bd8e6b4e550da871d6af
SSDEEP

768:BXuMZmwgCLWarR539pYaFM9RfPf7SSiSSHzksDRqcn90ufKv4:BXFZmGWSj7YymRf37SSiSSHzXscOufKw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2204	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2204	AcroRd32.exe
2204	AcroRd32.exe
2204	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cf574b108e5c84aed54a9e6386f7bfd1_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
43e34a230f9cfbd902c003a2cc4ad43c

SHA1
e7c90b87c3448bb2d01442f154cb5d3d4390ab66

SHA256
53de9ae5768d3f6708ace23ae7ca56b17e6bab884e2281dea61b5ccb481a823e

SHA512
654e2c58c482dee5ba35682ed1e866cf59361248ee3af9c1439066ee743c35332992ee6f87efdb09e0bf3939e982cb1ffaa2b1973bdf8f70755a1e09b36ce858

Download Submit