8d096ad4f4624eeeb32986cf869a026cfbe093d2fdf16894aa6c73f228d18d8d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dff0d3ed4389bba2adb806537c691d06_JaffaCakes118.pdf
Size

46KB
MD5

dff0d3ed4389bba2adb806537c691d06
SHA1

0e7d711db3df22895244e713b9ee85e46915b9e2
SHA256

8d096ad4f4624eeeb32986cf869a026cfbe093d2fdf16894aa6c73f228d18d8d
SHA512

f0e70730faa097024c1cdae671c659b655e801720ba59eb015b2d2d653443e4a3461a646c4a5a6666e842292afba58e0d8d5501091c8e8d8d4808e821a5d2dfb
SSDEEP

768:egGzpDkpsNxQMNK11CQEmZbWuFHcnAO7aTKjKEPtA/KHWx0xHEHq0/cb6pYp:bGFgps3QMN1np7h1A/KUxHq0Ub6pYp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2616	AcroRd32.exe
2616	AcroRd32.exe
2616	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dff0d3ed4389bba2adb806537c691d06_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b96931843750b5c5cdfae6849180beb1

SHA1
d348e9a804ed6911d2fc76fd33bb54341cff9a01

SHA256
33f70020a673c2322ee1f56de80ed2ff3e81e12783e0346092457886053fb177

SHA512
4d68f46ee36e2f61c77bf24f713d332c2671fe7b753465fe731c1bd51fdaeb321db7e7cc05cba07ca20be6fc36ef7b136119134a890243d5d9b8ffa985b4928f

Download Submit