af6c2efaaffb6b8eb9a75dd431debbf4ebd2faa34c9ca5df2f7c484978699fe4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bb3bdc7e0bca69c6c1438b802dca13f_JaffaCakes118.pdf
Size

92KB
MD5

0bb3bdc7e0bca69c6c1438b802dca13f
SHA1

8dea0596ddb65e79b1db9897fa1f2ed1e4d00b2d
SHA256

af6c2efaaffb6b8eb9a75dd431debbf4ebd2faa34c9ca5df2f7c484978699fe4
SHA512

770acb24e0fba52031c81d3e144217e9395ffdc0994bb47447053bbbc81bbc90579c1489ccc839f1df497911061f35ca424a9e0e994ab3f2fbd5a36e3f7685f0
SSDEEP

1536:nMZ0YgSZXdwN6WdWhUcOklUih0SGdBO3C4jMdahvmEZRWAb1JkJkfhZWOpOaZnb+:SISddLWshUL/ih0dMS5ajfUihSaZtle

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3068	AcroRd32.exe
3068	AcroRd32.exe
3068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0bb3bdc7e0bca69c6c1438b802dca13f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f386cecf70961a90f6e43d2755459089

SHA1
a874b0051dcc1dc8c261b34088e84a51efb324fb

SHA256
8e98f8bf5d712e0f38ec8c36fabe30ee33839b3cc2b695d81e49318ea50a159a

SHA512
356d62aa2b3b1f41b6d11d992aa77a22236c2f08bed2857c0bda7c51a1838eaae855262b9bc72d33291f3afe6cba76c7ad5f7808e0150522b60f520a123e825a

Download Submit