0c62497896ed3e4eb522b4762dcbc89656363af296d463d21316852b4585a309

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08dbba483f637ae4486905474bba18ec_JaffaCakes118.pdf
Size

45KB
MD5

08dbba483f637ae4486905474bba18ec
SHA1

1805fc55cba510134681f3b0ca7d6c2264b2bc53
SHA256

0c62497896ed3e4eb522b4762dcbc89656363af296d463d21316852b4585a309
SHA512

54ce7fa00ee87327c093e7395683d1f955fdf8e5c53daa4b1cb7443ba8ca69effc028b2bc27aa517bbf7875d5ed0fdf7b062a2a48eb832d202f997fa80abb3f0
SSDEEP

768:IaKCTqPIHijtOau06il9LIZx+pigPBqMyGC3Bz7J0IK0ZzKyr0W:IgcIXml9sZxC5q3BXi9OWyr0W

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\08dbba483f637ae4486905474bba18ec_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3bf55d6c13db7183a170d63cc578fe14

SHA1
6c6c83ab03a0ee678289296fdaa0e22a1af5f4f2

SHA256
be55045f5e106b22077c7d6afa8dcaf84711a785fc61775312fa085ae110c202

SHA512
f817180dd8e0820b95b2386a60c178d41af00d6be810bfce8d8c1190d6ec5442e3217ee582cd435a0f5edc78895e2d7e6b9db3484706e5ffe2895da4d3c5e26e

Download Submit