da9a6ac1e0f52c6eed4f6280632cc6581c7c5b9679c32002d0731dbcad058931

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08403c9cdfc01b409f8f7993cecd94c5_JaffaCakes118.pdf
Size

93KB
MD5

08403c9cdfc01b409f8f7993cecd94c5
SHA1

d996ed2c9e502d0d9b0ded91e361cbbb456e4841
SHA256

da9a6ac1e0f52c6eed4f6280632cc6581c7c5b9679c32002d0731dbcad058931
SHA512

87ee17e119e7c01bcd47ef7380b8241b100b2ae065f55d19375c3706bed6edafb163dd93aaa648af8ca7e3451e2a797e1989a8190d25e07ca3d7e32005b22f86
SSDEEP

1536:ZytHSE4y5zSCSg43RvheFizGzWMvDniEAA+r4d+Uu2lNhXOekn3QJWepOZrW3gY/:CyE/5erzG1bniEAAg4YU1Ye8Q+ZhYwGv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2440	AcroRd32.exe
2440	AcroRd32.exe
2440	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08403c9cdfc01b409f8f7993cecd94c5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a30f2fc42b2a74efe39dec66464c7440

SHA1
dce9f70e8b34b49d56e036398ac57ce7f9b21bd1

SHA256
1445d00e96ba81352e5edc58802e363031634c19292f6322e64dc2db8f47390b

SHA512
4631a98e92d794d22ddf737648bfc5f5466e114db713f767d9077097dcebce395dc734a86058c381d241a8aecf58d56d7608702227eb621b3bb9af1335abca6f

Download Submit