e242d2bf5f8c6abb704ac7c39a81d7bbf26c8609c028caffade3ce6d6cb03736

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08075ed1b6bfc983fb9c99cea360f9d9_JaffaCakes118.pdf
Size

86KB
MD5

08075ed1b6bfc983fb9c99cea360f9d9
SHA1

2711018a9ad0e928bd4f9b7ce8786fdbdbb8337d
SHA256

e242d2bf5f8c6abb704ac7c39a81d7bbf26c8609c028caffade3ce6d6cb03736
SHA512

207e0e69c939b4c91b7291d14d62978bf871916f0b740761736baa48cea22df59003aa373b5f59b0c4047f0befd5ca92b27b538fde30c9358512d63e57ddf9ca
SSDEEP

1536:yCpQE7KYxHeE0bsFf/yrM1C/+FyzS+ETIU6FHM88nIoOMeaWWYpO26OgY6alidWJ:Dp5aE0bst6oQWh+I6i86Ox02COlijvLy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1908	AcroRd32.exe
1908	AcroRd32.exe
1908	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08075ed1b6bfc983fb9c99cea360f9d9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
43e703d065231cce99d09e51858416c5

SHA1
bc2beb0dc5026d90c00858a558d79d840d4eca7b

SHA256
f6ca4b672debfee35a14c27f41da279477c50f4bcdea35d770e100ebbbfaf145

SHA512
980cf2b4f086a1ae492894e6a538f48032fa1dddb771d43e08e58f455715447b167cb48550751bce30e0cbe08501a4ef1d62ac8b0508e6d61cd10ee954e10792

Download Submit