d23da85cf1fd460219eb45a73e72d6e54706fcf53b3c43d61765bd706c2217ca

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09fffa05ee815864fdb57decda3a3932_JaffaCakes118.pdf
Size

47KB
MD5

09fffa05ee815864fdb57decda3a3932
SHA1

50624ea277a30894722b270a8e9577cc4717881a
SHA256

d23da85cf1fd460219eb45a73e72d6e54706fcf53b3c43d61765bd706c2217ca
SHA512

3c852d8cade0985af3e6f35e71c99e4c6420f2c08b56589a676a5e2c84333c1bce3185c83c2f8b2e4cc2357d97825b731a6c17f29b46ac0cfe7788dfc4ee2eef
SSDEEP

768:ZWfIlN5Kl/1bNyccO+IvwANljOhU+Xz8xyWufGVodIXZxoi8+YfJIiEPu4Cwl:Mg3gveO++GB1WdodUZxoi8+wbrk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe
2416	AcroRd32.exe
2416	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\09fffa05ee815864fdb57decda3a3932_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0c7ae43a3485f5519bba217845fcb1fb

SHA1
d5545dae2846dbbaedd13e8132bc1f2891d4c37f

SHA256
461ea58f59e453d6c3387b1fe062d9d877215c5ad1578c54a8d2008abd7ad5f6

SHA512
c00158398c2e8cf0a457f2e16f6ddb6d3b33218b05018f29bffde436ab0c7aa6eee3557fd9191f6c93eb6324557ea5e18bc42cca087162c2216af69f764cc7f0

Download Submit