6e3523a34e7075cf68006f037c12d0807064bed23e388ee9038eef836cf7e343

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09cf049a9fe8c2979b41844b2b3a2b99_JaffaCakes118.pdf
Size

102KB
MD5

09cf049a9fe8c2979b41844b2b3a2b99
SHA1

a4d37190334d7178630fe433de2b2ad00a83ed83
SHA256

6e3523a34e7075cf68006f037c12d0807064bed23e388ee9038eef836cf7e343
SHA512

629efe121d341eed7a8d540ee544e5e8e97f5cf7a89b1b17b23c4e7ab5ac0066849b62de7f5afd41043525c8c77c805eea4cc679436f80c68121ac2955eb2589
SSDEEP

3072:LnrGrZV1JNMSOpDdp0tMxjc8uP4QpTgmLGRJEG:OrL7POpJpTjqPD6hp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe
2600	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\09cf049a9fe8c2979b41844b2b3a2b99_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4b62de5f730d9ed83aa37de89676bffe

SHA1
c22865851f48eb8e0482ca740288c8804061cac4

SHA256
4149e08a6967f6ef4df28c0ce5d002ba7f3108c7215b3d0422642c788c17035a

SHA512
c9dffc653543afa084439aba92c89427c7b53ab7d951e49b01add1222f6573c85b08c5d2aafbeed7e932195afe87aecc2bbfbcd367ba112f5b5c9b60c1939725

Download Submit