8edba0f78649e2aa7f12de999562b8b76e732acef53b2eb5c5ccfd1d7aabfe13

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

062afccc3577660990d92ed519dd2a74_JaffaCakes118.pdf
Size

75KB
MD5

062afccc3577660990d92ed519dd2a74
SHA1

30c8ac56c39748183d5d427b2c8efcb4a22224d2
SHA256

8edba0f78649e2aa7f12de999562b8b76e732acef53b2eb5c5ccfd1d7aabfe13
SHA512

025baa43536052b0138a6b2c749e08fe34415edfff0732556daba8b82a9b3c731513824b7a7cbc752894b125381378439154d9cb95f8ccfbccdf5f2f302cafea
SSDEEP

1536:9cHr4bqKGH82rRWLGDg/Pvlmv2sGOlwWt6Ibc9W8pO7ynN:aLhnH8yRR4PdmvrQIbc878

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2920	AcroRd32.exe
2920	AcroRd32.exe
2920	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\062afccc3577660990d92ed519dd2a74_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
741a7efc4c3e3cc58e52cc6c0b5aa924

SHA1
6da996b107089d3e98d7b2927ef9b275fcabca59

SHA256
d253a2852291f8683f2b53a99160e675f6e049586a95578c73b456e2b9bdee99

SHA512
66698f2f2463c43c4b221cd46ff8cf71b4651dcecf29160b0250055c0b7ebe03b1ea28b9f3e48629b17d59a31f4dfe081e14a0779ea538bf17ca77c167cc28aa

Download Submit