0fce2b0b0eccb8faed4e97d0ee1e29a5cf9121e708642b0ad0bb9cae659be258

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c9c64800fb4053ebff6f3134c33c207_JaffaCakes118.pdf
Size

90KB
MD5

0c9c64800fb4053ebff6f3134c33c207
SHA1

c9a2240e1e663efee751e1cf575c2ce0433ebbfb
SHA256

0fce2b0b0eccb8faed4e97d0ee1e29a5cf9121e708642b0ad0bb9cae659be258
SHA512

b0af543d7111160f766393d224b89c01ca998ba9d2e37f3ccaf16ddf8e2654ad8db808640cbc8d0837216009724734d8f2b47017e85d2f9d41de7ba889a35138
SSDEEP

1536:YMIjJof2x4ZE/vPZ4xpPDai3+/tSfMPKU2u2yONh9IOXFpKWBXO1rTVGWspO2G7p:d3kQE/vsFs/5SU2u2Dh9IOXGrTVl2G7p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2164	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2164	AcroRd32.exe
2164	AcroRd32.exe
2164	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0c9c64800fb4053ebff6f3134c33c207_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f56755df1531839a43aa0a3775a23cb8

SHA1
a473e2e183ce4b152da15c833edec0deb4d425a6

SHA256
cdc40b4a99e51530ba4c5e0660664aabbf761e8868cdaab02837567904d8c1d1

SHA512
53b24e00f2e2de896de0572f54fcaf82fa2b54f6ccd5ee650b470f217d65eb1a46c702f61cc2f333ed10e3be01d79c6cc7d09354a12d224cf32f1b6ec726e7ad

Download Submit