3bb39df94d373c0e1e63161345b46301982f408f63237fb050db2373c43ba5b8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3e659a305b13470d35e875643675ee0_JaffaCakes118.pdf
Size

40KB
MD5

d3e659a305b13470d35e875643675ee0
SHA1

a75d08fd9fa642d4feb9adb4034b41f8b8826403
SHA256

3bb39df94d373c0e1e63161345b46301982f408f63237fb050db2373c43ba5b8
SHA512

d8f8083389e814e05ca7d2557466069d177f885a2f1578ccf4670588808c94cfe2041f0d0bcb9dbb523fb23ee3e4cd6c36bfc9f1730f1f808a4e64a783a47532
SSDEEP

768:5XuMZmwgCLWarwE5HpxAatMOWkfRfRcYR+5WtGzK7Cijwlbepx49Mwkpb:5XFZmGWSZjAatMObfRZX7/7CijwZepWG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe
3064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d3e659a305b13470d35e875643675ee0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0baf08ad411e998cd8bd672939914f9e

SHA1
f070a1d9b75cbf56f7825e8667a9799f7a9db6b7

SHA256
6ff4e3fcc78b67d7f5c8d1ef8bfe0f5a022a35bed8823b4ccf3b61b6588a192b

SHA512
4cf23ffab1894da2f8baa8a965ecf5ac40172ede86b8b5f5a428d4a2b611fe7faa63d553823df931eb36afeef364aa2fb93aa94a21db99c4d398f6eddec40625

Download Submit