8eaa0e0e042eafc8baebcdca558e1bb396212089ccda882cd95c833ca41ee60e

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f984bbf5b722a8db2252412e564c6d8f_JaffaCakes118.pdf
Size

48KB
MD5

f984bbf5b722a8db2252412e564c6d8f
SHA1

b99ce61cdfc584bab4420d9392714c802d94f446
SHA256

8eaa0e0e042eafc8baebcdca558e1bb396212089ccda882cd95c833ca41ee60e
SHA512

e22e2f57346af86590f97117803d429e953b05d31bc6bf19346837bd85edca401a7ee58a135abf41b0e433f174634e72600f06379dc4bbb8173f5b8fc8ce68ae
SSDEEP

1536:/q6+mPjavxLwdXVgkNj6Y/w6BIejTqP5ydMWYoTSFXKWZOj5ZfbuCPwxLrwITh3Q:/UrxLiX2kt6XKn3kU6j6KD8VlNIB8q5Q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f984bbf5b722a8db2252412e564c6d8f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
29ce74cea964b2058789fc7ba94d626f

SHA1
7cf1dd0cbabdd3b9f944205bfa62a47a8197f73e

SHA256
9b4c1c006a28f95f5f505784a74d93c345d216d26f09fc00a844bbdb92b5f442

SHA512
7c92c15b167b57f1493f6ca2d0f7ac8b7527ae92e7e4eaafcabe577c46b4eb34271d615b9dac55420205128b8f00a6887a86a6e36ef036e06abe45a1c795a19e

Download Submit