3d962f2386f6addb53fa541808d17af4c6cdf233825c8bd461c3186b50bcdfa0

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d4018d85cc0a5ff994ce75e685bc4c8_JaffaCakes118.pdf
Size

93KB
MD5

0d4018d85cc0a5ff994ce75e685bc4c8
SHA1

ad13e254e92d0cd1a13dca1929ce9db3dbc88e08
SHA256

3d962f2386f6addb53fa541808d17af4c6cdf233825c8bd461c3186b50bcdfa0
SHA512

6b4d9363663f19b4a961752f0888f9dc017944f1a04a5f64833fd03463c2a5c3797df6623ccf062506e1204afbc7d4dce6ac2f714d97dfd4a77add6accf3e444
SSDEEP

1536:Z0wB3YEKQ1B6przV+3PDWa4GDOpACEhGCQ3WGGTDZ+UWabw4PAqyWjpORWpC:Oa3YEKQ1B6przeDWa4GYfEhoLGPsGkR7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2332	AcroRd32.exe
2332	AcroRd32.exe
2332	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d4018d85cc0a5ff994ce75e685bc4c8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ee6dca6d321ec0c158d641d33757d771

SHA1
8bcbd64d2675dfc0cf8da8cb1cf874f60002e8d8

SHA256
8a58fdefba5896dc218cc2a8f586cc351b374d3e4ca8709ee46eb0ec80076522

SHA512
264b0ce92cf0209812e565bcf47a0923bb0a03716a7fb81b5224d458da350375ac235f7cbd1c44f0f87a92c50c86ee4ea3465fd5240f8623ec5c534c2bfbe5f0

Download Submit