b12edea054c0a3130cc84aae8ad7204424a658e8cf0342fa02872178fd0a380a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d977478a6a44b8765bef6c39baff4a7_JaffaCakes118.pdf
Size

90KB
MD5

0d977478a6a44b8765bef6c39baff4a7
SHA1

13853cba3aed3a41043aa56cd19cd8ced3a52284
SHA256

b12edea054c0a3130cc84aae8ad7204424a658e8cf0342fa02872178fd0a380a
SHA512

91f2a0f90d75e0a9daca3a7624ed7029ee3fed8e4eb78954d5bb7fdbefcbed4cac87e2a783da29f7e5bae8574756ac7e2263657a38da597fc429b6f49486e145
SSDEEP

1536:Yt/oFGf347vGJLbXfwSiFjdcFd+tUc6CKwOIZQPHiXilSWYpO2+WG8HlR44LnfMZ:E/oF034LGhLf9iFKFdQUxJHIW8ilp281

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d977478a6a44b8765bef6c39baff4a7_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e823aa34ee3574d8d902f7716595f589

SHA1
f4a00802007bb16bfb07d8356c9622ddd5d84390

SHA256
6e835f698e679eb7ad89c9700600a9ad736c582b1a93324728aa296ab143318c

SHA512
cc8d69320d80c933d76c605a1dd8cbf0a9c2896b1d64968fd6525650cacc540a736f1583bbf16c554b2c47ed9a848f9e3412d3c56b20007f39b83168f8b35547

Download Submit