30a839db6b6df7836328367cbe14ce4bf56dbf3a78abbcbe3e2c600d26e12878

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09bd4e77af9d4e71718731ed35a9c71f_JaffaCakes118.pdf
Size

81KB
MD5

09bd4e77af9d4e71718731ed35a9c71f
SHA1

4b06301ac157bb7e5d1b6111810d3cf8c97e8acf
SHA256

30a839db6b6df7836328367cbe14ce4bf56dbf3a78abbcbe3e2c600d26e12878
SHA512

576165f393084708991d1b154be8f85c73814ad2bfe665e4af90e44706e50279027f52eba02102a7f32fb74c5d761586316bded38dd4b073231480352360a288
SSDEEP

1536:ogWXvXduJwCMZ52urN3RHpsz5a8WXVm2TIwvZWbpONaLG:j4v3CMZ5BB3RHkgTA2swvbN7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\09bd4e77af9d4e71718731ed35a9c71f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5f718c060e4eb192f7309c43d296d0f5

SHA1
3fb440a6925a1b2c9e98f9718aac7c4a27f6e41c

SHA256
11e9a66b1d44b5a0aa85c505153c00e85494607e79a9147814b57dfadfb711bf

SHA512
7095d8e4549574a639fcf9f4a9f7a3432ce536becda71ad0aa098ba2ab51893a62a7f6d4fb15496a92724ba28454535646e0ecaaf5ea192f9d3b5c057f917617

Download Submit