c6a77a622f7a188c168e87c73a7f986fdb67053cb9738c77bf34837a8c0f4f5f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

098e2dcc605df367aa2666f48487585b_JaffaCakes118.pdf
Size

70KB
MD5

098e2dcc605df367aa2666f48487585b
SHA1

ca0a84b4ffd44d05f0228aeb0635e7b259e3421f
SHA256

c6a77a622f7a188c168e87c73a7f986fdb67053cb9738c77bf34837a8c0f4f5f
SHA512

0c4f75d727195b2431a15ce2ef43a26459545af416d19ad9aee46d17f33610954c8f1728427290b9ded409ff41d12ffb646286f8f8b58019d7c5c29f522468fc
SSDEEP

1536:xT+ZKzIg9B71GlLVqwfJmO0p1KZpyGRmX5NBeu87OI7NcjDHqILmfG8:FzI4kNVqWJI17bBe97x7N25Lmp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2352	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2352	AcroRd32.exe
2352	AcroRd32.exe
2352	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\098e2dcc605df367aa2666f48487585b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6c2b5e51496db1a8f4e748d373295f87

SHA1
0cbf2784259b9fc0560af5082705eee64b5a1a3a

SHA256
6bd6d58005c7e3acb2df3635e48ba72026496de0bda6a45e23a77de4b618c84a

SHA512
e0331287f83566e021de154aacbbe06aa7d2a74eba93faf90189ba67383089309f568ebfaa3ff4559c74bcdc6d1406dd48e3f42f9c51ad75acb63ee27cb59fca

Download Submit