ea57fb003f094d7a01a952ac38848eb64ec438f78d9fe27595b12aac7545184e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0902d4f9ef900ef59bee2c8bde14cd8f_JaffaCakes118.pdf
Size

85KB
MD5

0902d4f9ef900ef59bee2c8bde14cd8f
SHA1

dafd3cf1823c0d7d7167aeb338ed6a90d16892c9
SHA256

ea57fb003f094d7a01a952ac38848eb64ec438f78d9fe27595b12aac7545184e
SHA512

3ef89dc548793b5488fab4b32741eb6d60fd0333a159245c311240a8ef8c4af85c383af8ac7005c97386ed1b58bbfc41da88999f678f28c92e2425853c631dee
SSDEEP

1536:68+euvduKX0KUsqJ5yhz2P8qaShCP8Ik2W46c9BMjYmWWOpOwrWeLelF:pEVXDNSIMnnhCPbZALwrWeLu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1984	AcroRd32.exe
1984	AcroRd32.exe
1984	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0902d4f9ef900ef59bee2c8bde14cd8f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b30d924279d871a77dbaa060adb2c2a0

SHA1
0c3656c74966d81f4066905f8f1321857a8168f8

SHA256
6e55d428d1b77a15edf429f6745ac9c4bbb68ca8e652b132ba25f1f4630c04ac

SHA512
c23dcc880bb9dc4c2145aa132a25a14d805c23cb8bd0f7cd5788112f74723aeb7bd672fa1dc42d6d85421ebbbe90f8018317d63c2efa22b42a9f4df9ff3c63e4

Download Submit