be68a4ade857852f07d2a10741da05b9a1562fd012c04016083576ed8e94ecf5

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ecddbaa4a5132695f7de5d28971c03_JaffaCakes118.pdf
Size

94KB
MD5

07ecddbaa4a5132695f7de5d28971c03
SHA1

05f8d4edc1be3110da239c7dd57a32f0bc5c7dc5
SHA256

be68a4ade857852f07d2a10741da05b9a1562fd012c04016083576ed8e94ecf5
SHA512

0a00bf9fa071a67d61293e256695a3e9df95a61f794de4bd7d198c252cb987b57293e60b1ffebb6009b4a13489438f7ad8e0c49ace4cb2cca4b4533a7ee10c1f
SSDEEP

1536:Q19E3tU7DZ1MxxZys3UHY9foNOZMoY4kSMidY8nZR+VJhqzbMyKLAWbEn:mE9gCEs3NaOZm4kA29LhiMy9CEn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1644	AcroRd32.exe
1644	AcroRd32.exe
1644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\07ecddbaa4a5132695f7de5d28971c03_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1e341a0b7f1743381a06c86611e88c0b

SHA1
3b34ee2f6263da6c478f1a5ddcb1c6b2a2a66c3f

SHA256
c6acbdda792bfd2966a566cc6fb89186f1eef299518d30d25148f27ad5f6954c

SHA512
a6d66eacece62c3175a0d7caf4f449c92399fe10a92dc76566391bac9f2677a604e82e4e93411173fd46794810fd43d3ac134da9ca4f5589c1b07ba0afa74d53

Download Submit