003dc60da57b2255f1f88d79d9a5d6041c40833d339f616a19c0d667a7788e6f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0900de8b9c3e10d3452382ad27dff90e_JaffaCakes118.pdf
Size

68KB
MD5

0900de8b9c3e10d3452382ad27dff90e
SHA1

b997b9d563e1712a8a86ec2145c50d91c9a322dc
SHA256

003dc60da57b2255f1f88d79d9a5d6041c40833d339f616a19c0d667a7788e6f
SHA512

db2d1a032a04ba6424ce00b0094002e811902431589a512668379b3e28d554c81d9de7ac34dcd966aaaaf0e4ea5799f9950da31efa6937cf953ceee9eb6a3ef1
SSDEEP

1536:Ff3tYw3l41B+6BGe1bwQq0sjb06wxyQSxMbClF9OsA:N9V41BIedLsjbuyQSxrjvA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2100	AcroRd32.exe
2100	AcroRd32.exe
2100	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0900de8b9c3e10d3452382ad27dff90e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
35d4e34b5eef6d268ea5ba3ede709d68

SHA1
f9a58d78b47d04ef85208710fa48814fe55e7233

SHA256
de1dd86e9d1cf315088c28f2b8509ab847bbfa0da4b35fe87d4575c24892c4b5

SHA512
bcb242e520ce7bf8faab94b978fb0192fcd3d9c832180449807e7952ad71fba8f1183d557657ca0ec51dea91bf4537daefb10acc4d347148cc7e9f3ab364a5b2

Download Submit