8cdb4e3025ec11f6d37ce9785db13c16f08f5bc2bbe8e9fac250b0257f7020c3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d1dbc62c85e4d8460a708fcfe1fcf59_JaffaCakes118.pdf
Size

74KB
MD5

0d1dbc62c85e4d8460a708fcfe1fcf59
SHA1

1a0ae0efe90cc34cad620e3a772e127fdc31634b
SHA256

8cdb4e3025ec11f6d37ce9785db13c16f08f5bc2bbe8e9fac250b0257f7020c3
SHA512

ff1d73de0dad44e4e5d36e0c10bbc2764b71b7be6946323daa89c8377c61c07c0c3e53e6e166413ca7bba9a7d3cf8a5bd8f70ab981a26081453533844d7edd9a
SSDEEP

1536:RsXd+vRNmKzqT0PNZib+REHk4Q7d5LrikvUHOfZFHuuEgm1:SdCTqT0PNoH45LGVHOfZ1VEH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1580	AcroRd32.exe
1580	AcroRd32.exe
1580	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d1dbc62c85e4d8460a708fcfe1fcf59_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7d7ca12e49d2ea4ae884b66aeeac8aad

SHA1
10a021a19aa70e03bedbdc62e69ceebbf63e9d1e

SHA256
98243475be5bc30aa0d12c2a700bcbf0871eb9ba91efc7837b384b1c192be711

SHA512
c2693b960f4cae81bee8ad3c2914a60a9e098392ce495a665fbd7799bdd37586452b13929059c1dca1944b436ad94425e5b5348238b019e19f73c9a06473981d

Download Submit