08188140c21903452f249263fd53e9f95b8e366f0779710f5130a438d561ed11

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

056681ed1696741404117d7aff3fe304_JaffaCakes118.pdf
Size

68KB
MD5

056681ed1696741404117d7aff3fe304
SHA1

dd61cfc29f9ef2d9d59742e574a2c4046350f5a7
SHA256

08188140c21903452f249263fd53e9f95b8e366f0779710f5130a438d561ed11
SHA512

6dddf1bbfd0c7b85bfb1fa04ad4657cfe9fe216997f20fdbe6bb532df67f5d7bb0de4f260b0764346404a28699337bbda7d888907930ca00fbde5775206aef45
SSDEEP

1536:VgIELvxbZSV2pSJcS6en+/HxeAY+m6L/fHxl:qvrxaeSKJen+/RetW/f/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2112	AcroRd32.exe
2112	AcroRd32.exe
2112	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\056681ed1696741404117d7aff3fe304_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
70e9b606c4c0305f4d5ee1433b037993

SHA1
33f7d74e4405e23ab004d80aa39e42c208df0bc6

SHA256
c11915d57dc53b61f7bc2bea450db2609969b73c85002a8bd58a820a1501a53c

SHA512
bac6b19d91a966f467ee99c2197c8fe506e25c2a8a9e34e7c2a5330f39e4082a2e0985b9d29df2706bbf64807c6cd14a190a13471810a123376ce0c231be3ed2

Download Submit