275413741b893bbe7d6bc466f695f6232ad927802df101fb09700a95644fb37f

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ad70e83b5f849dd9dffaa197c69b16b_JaffaCakes118.pdf
Size

75KB
MD5

0ad70e83b5f849dd9dffaa197c69b16b
SHA1

60185f2afb1f99c11cde043dcc655ae56fefa02a
SHA256

275413741b893bbe7d6bc466f695f6232ad927802df101fb09700a95644fb37f
SHA512

9f3cb2e96e8bde6e231743ca782d95bbb7ac3fbb2197ce7382edfc6d3287252910eee319fdea6f5e46fca227c034181655a0d3feb6ef213724923975958eddda
SSDEEP

1536:6YULYNLhs0r8kK9qe44XMbfTOYooRL7TfMWUpO7qW+Rx7OTzEsi8Bj:pU8dhNa64cbfXVRL7Tfv7wOz9j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ad70e83b5f849dd9dffaa197c69b16b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c3338d00aba6498cf0665b5a66566353

SHA1
25872cd3a76f95baf582cd684810c8639a6bec26

SHA256
84f7612f66496fdb0c56e6d8750fae40e3e49281f2773b7157c39684c43210e1

SHA512
500910a83d884ffa4e6e8a7e50bbd2919aae3d443ddbf6cce797a8ed80e524add6e3e71f89d6e4991f118f341349f6e1dca4b9813c802e4f48e50c305c5504e7

Download Submit