0bfef20e052936a808881dbe024c6e980d71a6a80e3ea0bb82be7c7e6dce1149

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc07bae93b752c72ba67713a78237008_JaffaCakes118.pdf
Size

83KB
MD5

dc07bae93b752c72ba67713a78237008
SHA1

83d25ce0b0020dbf9507eed158f4aa55e114211c
SHA256

0bfef20e052936a808881dbe024c6e980d71a6a80e3ea0bb82be7c7e6dce1149
SHA512

e90c7544e4373f320b7875311787f2c7bc0a1ba2623434be62a53e7045a94353b421611e68fe2a295676c9549a9006596c3f0956880c5fda24146ff219c63eeb
SSDEEP

1536:nnK4I5ZGbGg9t4drhE9XkMPe0V0/5HBbcqLTGC+xkyXWXpO/EWlkCf7mWrfiUixj:wZGqtZKdVW0m/7NyZ/hkCf7cxzzb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2516	AcroRd32.exe
2516	AcroRd32.exe
2516	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dc07bae93b752c72ba67713a78237008_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5793781c32265931be0765f759919e40

SHA1
3894616b24a6f86b324cc41f5c807d4dfdd75267

SHA256
9595f346f04aa1b9fb0a2b8de65ad6cd0aff286a968c9f1ee3cbff0e3122d01c

SHA512
b5f99079dbad30ee7d1f6dd1c3d3967857fead8c640cbcf176c0aba97ebc44dbf18211c16e3feec168d6574619e86416492a73a799a1dbec8d00d4aa4eac5397

Download Submit