7de47a0566a84ed6a0acf215b44597fe38095f625727392c3074b85046e83698

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

081ba7d06963f58891d0d8b3cb14d4c8_JaffaCakes118.pdf
Size

35KB
MD5

081ba7d06963f58891d0d8b3cb14d4c8
SHA1

efa85ee56bb592e4956255f90f9b48d15b6bbf8b
SHA256

7de47a0566a84ed6a0acf215b44597fe38095f625727392c3074b85046e83698
SHA512

2fafe9cf692018817974a10cd4aa11672aacda89fe9548e4f0528194796b8b5261452bd0a6032de04383c2dbdbbcf848ab2b67ea43b432d84b27a0423d6e46b2
SSDEEP

768:9DuVQ5rCuxjemtp2a0Oq1UViBgqf5JCVewEOlb5rJCz6vh7eA3NUEYSJmrqQ6I:9DuVQ5mucq4a0Oq1UViBgqfAewEOlvXq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\081ba7d06963f58891d0d8b3cb14d4c8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3f0d173d912878e1f7a1947a44656368

SHA1
a30dd0a68e2cbda558f5355b2842247c03763cff

SHA256
63f3d8127f0792188552922e7aaf378e0d5cc387bc587e19ec9cfabcd401dc45

SHA512
7e4a730e9978c097f2d5fba4d8753b5bfa6821c349f11c571ebe707ef2ee9ce412c3a94fb1fb885b398db6e6e38c156b3a53dd1d53c893163e96cd7d9d39d6e1

Download Submit