db25319e70dfc7ff345c2231aad8cac26269113f33f3b60ab5cf4a0adc9d0a90

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0434309614e7ff1cab3fdfa4ef3f718a_JaffaCakes118.pdf
Size

51KB
MD5

0434309614e7ff1cab3fdfa4ef3f718a
SHA1

df94502f95771aeceb580b5d1b00be20be842f1b
SHA256

db25319e70dfc7ff345c2231aad8cac26269113f33f3b60ab5cf4a0adc9d0a90
SHA512

23d684ba9e606c7d92fbb4f815ac234b0aac8d9aec41cc0b822af35b197922d47dae10a4d82f7d4fe0c0f4799f7feb8ebcb016b0dd50e40968835822bb31c950
SSDEEP

768:jgGzpDC2xlU+E2I3o4wieqxf0BdsUAuxok/5m8bXS4Dgi4iOi04V8G2FM7us6y:cGF+OhE2I5wi9A1ok/8tIgi4PVy7us6y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0434309614e7ff1cab3fdfa4ef3f718a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5b70220c14286c69507da7d55ae9fd39

SHA1
d50aa8b0c18ab8d99b62bff55d59dfa90d1f634c

SHA256
8c4e866d1f7aa5f724307ff4b18d691b169078623e39f4f37c146626aeac0d5b

SHA512
4c63d1b5ca77159fa3820751878019f223ad18f73dadba0f99552cda0d2ba95ec4dc01f473d073d02d3a890cb9694e5b51e909a22069882e9d57a453a7b4b546

Download Submit