de4071a86213f4b84bbc3a34ca7026153c570fbe5baf3064bbad9ec0deac7f8c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09bee5e3e35766aa65ffcffb97cdfd37_JaffaCakes118.pdf
Size

309KB
MD5

09bee5e3e35766aa65ffcffb97cdfd37
SHA1

9d104c2f443f903070293cf320e4511e8fed6b57
SHA256

de4071a86213f4b84bbc3a34ca7026153c570fbe5baf3064bbad9ec0deac7f8c
SHA512

8c6b3ae72e969e352f6fb1aa45048e0a64440451ecebf793e64f94201e968997a6d671f9089875edb1e370559caa4907252bb01ad9e50359e1946f95ebd36d67
SSDEEP

6144:HNZqhVlvJOMveOPlkS7kAJ1kZLDf8QktSQj7V6Ehm/3+3BGxfE18G7AJ5b:HNYhnJ5kS7kYGDCcWrm/uifE186gh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2504	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2504	AcroRd32.exe
2504	AcroRd32.exe
2504	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\09bee5e3e35766aa65ffcffb97cdfd37_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fb55471041e5a46ee49f62068f0f5d4a

SHA1
5e82bb08bc2ac6c7b565a1afa6c9a19f9173ba1f

SHA256
8b6e99372103bd47070c2b451a65740e5facdb4040becc1be8531f41f63cb34e

SHA512
09ca8902b5ff02a6a6b847a5a66d28543c40c6dac021125e3e3b9f7842837ab8c5a72dd85544dd2fbcb004e1e1e7e3882b602f3fe2fdebb7206a74adc7c70c1c

Download Submit