b3477b5fa4dd5a02a3c7100e66ec71df74b91430a56e6277ff666aa8a523d210

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0ecfa29ec68ab75910fa7601458dc32_JaffaCakes118.pdf
Size

48KB
MD5

d0ecfa29ec68ab75910fa7601458dc32
SHA1

42ed719b403062308d271b65b4bc9356d92484c3
SHA256

b3477b5fa4dd5a02a3c7100e66ec71df74b91430a56e6277ff666aa8a523d210
SHA512

2ffcfe62faf87507272d34d958b36c31d9d20d641e4ad37efc2e3a081433b1520a3d657e5652d5bd5c715411159cd9becfc42a36f3572579d2e95a5e1055c385
SSDEEP

768:7p+KNr9x5w2srlIh5LlHMswZ+fiHuwOu8We+EbyDeLiiaRPgFytNwQ4O8:N+KNj5wvLsqXOuzbPgiiwPSC+lx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d0ecfa29ec68ab75910fa7601458dc32_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c6024a8be2d2bff6f73caef6e7b2586

SHA1
9a9a0ed626035d9c0086ac38f9494a7c9c46db32

SHA256
3c187c573e2d07d86a3b037ece9f1573b587f38c25bd0abab020b0626c6d9087

SHA512
027a1eaa3f2bcb8d88a612a14c8b5ec13e344c69f5941a80aedd5c3d621070a90311d3a213c42907baa16114019bf2b8943e4ef17e7f2de6020d2d8ae7acdf10

Download Submit