b36a8bb3391dc12398c78c1b92a18720cf55a0f7a62dfaa9fce06ef08c5c5553

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

10adf431682ad7c1320a4cd80cf09182_JaffaCakes118.pdf
Size

120KB
MD5

10adf431682ad7c1320a4cd80cf09182
SHA1

1396f326cf2a32cdaa8bf83bf8462cd947b161d2
SHA256

b36a8bb3391dc12398c78c1b92a18720cf55a0f7a62dfaa9fce06ef08c5c5553
SHA512

a561de18b9ff22edee1c2b90b6c7a5da997dd56cc2345c3ebf4df105aa0ac3e93d2dab1c753c873ffc8027622d6c688f9fca18bdd72a33260492fffc2a7426f1
SSDEEP

3072:567mxWiLYSZbijh8xrK7hCNE9DRUVR4pJVe:567gMSZuji9KE6y4I

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe
3064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10adf431682ad7c1320a4cd80cf09182_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
667da29424e7cc524fbd375b41e88801

SHA1
c59a82f4ff5cc3b50f5e3ee979edc490f8b52174

SHA256
2172f3acf536098f188269e3250f1b9bfb4c3dafd285d3da405aae14f7450ec7

SHA512
6b1521e3280e81e9ab393a785b1403de7d622d0ef960e1fd83fb5f4c281758ee4e0fe4706c9dffc66fd0db0fb44fe0f4e76c77ba977e587f0bcc560ee77395d4

Download Submit