ba68f056f12e483b1029d660aee44992373218d6b6a85edb1bfd679206167b8b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b87b0e2e80bf97efc001892977c4283_JaffaCakes118.pdf
Size

88KB
MD5

0b87b0e2e80bf97efc001892977c4283
SHA1

4f22a74e0bbe0e4c88bb32cc73ac0ca239bfbddc
SHA256

ba68f056f12e483b1029d660aee44992373218d6b6a85edb1bfd679206167b8b
SHA512

86ee7cbd443aae0c39114797500f2d61ecef88ec5e749a8b8ddc9dfcad592205b923418d1471d8c1804f90640ee6e4172f464009051d773cdb7f93ac79b99fed
SSDEEP

1536:lCcB5vjeSZdTAI/97FKyuNW98XjpwTOCDAO/V7PdXYW6I/tJHfNYQ51UVYWkpOT0:AejfZWI17gyut4j3VRXTJVvELT0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0b87b0e2e80bf97efc001892977c4283_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8fe281957259e69c2f699603f3945861

SHA1
61f1dc6131237b7d3d6c3dbc886f3d5a6eefafa3

SHA256
753d7626ba9ce024799dee50bae0e44795fc3a59eed5dc456a400e02db1c7883

SHA512
0b82886e36a4874e6ff9f50e383d1b2dc6154b2c17bf4f263428ddf67be361780d637609337bb768d86c99c45ea4d90771dd9b23545f56218cddb50530079d6e

Download Submit