420ec9a39ae21f7a343147aac7db2c37c195d60df367d6a9d686ba246c9e2e87

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

069cdc63167a2740a156a7e0d9a1d96a_JaffaCakes118.pdf
Size

48KB
MD5

069cdc63167a2740a156a7e0d9a1d96a
SHA1

e9f289dc8b721111d5b6abe76f6b650259caaf62
SHA256

420ec9a39ae21f7a343147aac7db2c37c195d60df367d6a9d686ba246c9e2e87
SHA512

a7327d1915914a532469c6d01a246d208046b7083177f6098aebff065a8217c89773578484c2cd310ab8bf2b17f06b2d2b5811fe3468296e3f42fe901e5c0a06
SSDEEP

768:ugGzpDpeA4CE5QVWFM/gltQdgWReNZSBUT32qNU/y/cDt+VQStuHC3S5I1r1j1J:LGFVeeeSBUTPhcIVQYuHC6Gr1j1J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1812	AcroRd32.exe
1812	AcroRd32.exe
1812	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\069cdc63167a2740a156a7e0d9a1d96a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b05cc32eebd56d55af857938285b206b

SHA1
4648582c0ec8f328ccdaec0d31f2fe60be4cf1f8

SHA256
5217f7bcd2b0078d52d4df0646f4ee4f202d0beaec1e744f0654fac86475143f

SHA512
1feee19c96d2a9018f53f7a95db228cad15f5f8e480f95150e024d52f6bce2b55c86da2e76c29556c5fbdc75d52ac07f84eefa3ac71f637dbce9e767a4445348

Download Submit