97d2c0e9792e1f561d816621f062ebd0099fdf6942943b2342857c6c7316dc06

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e016b029f3ae054d5b31e8468781a95_JaffaCakes118.pdf
Size

75KB
MD5

0e016b029f3ae054d5b31e8468781a95
SHA1

fc3b8f5fddc42f2b9842f4c17d828ab2a816f464
SHA256

97d2c0e9792e1f561d816621f062ebd0099fdf6942943b2342857c6c7316dc06
SHA512

c070ea82f5020616c3625f53e1356dd963eec024efe99895eaf0ae4c4c703273f046e14a3bada96e1c49cf94e4c2b47b1856ce1aaa27dd46f66c623fce1c69b4
SSDEEP

1536:DG2TB7pywJBpeh6dya9DgDYta6OmWjG4TWMwuWXpO/UZjL:plsiQIka9s886OZZTSu/aH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1364	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1364	AcroRd32.exe
1364	AcroRd32.exe
1364	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0e016b029f3ae054d5b31e8468781a95_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f639e33d7b11ecccdf725ad0672af1ba

SHA1
92d578c397dede0de19dd0af3bc05799740a0472

SHA256
7e2f29e1d791836d4c6528a63d8b2b89f27beb8ee23e93039fb814d03089ec0d

SHA512
77426d18e59426d7b5388b5a017e5da1f26564c1ab9cc605ce2e16d812399166be8e955cef5149a3c1d5de749c8f65c840236b1216845571f0ed247af2c1a6d8

Download Submit