d25351391dbc6ef63bbab393ef5b1b19b5d6e514b09d4e8642244178a939e944

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ebbd325661f640b3180eaa753260cd9_JaffaCakes118.pdf
Size

82KB
MD5

0ebbd325661f640b3180eaa753260cd9
SHA1

2b4c5bb193f78500a22142acf23a6e2d26c5ebf4
SHA256

d25351391dbc6ef63bbab393ef5b1b19b5d6e514b09d4e8642244178a939e944
SHA512

fd3bb0043fd6a9f34de1b52389507a44e625892c9f29eed7b7ce88fd9c31e60347835cbd6a709ed55e252f64dbbc3030193c3845296a87f2f6d3fdd7dd31fc4a
SSDEEP

1536:AVF6gq/dUqD87RtOUYD4gRlJofU3WF036/LeYXr2jKdSoWsZ8H9T47LYHWUpO746:+6gqFUq83pgTJoOzCL1XrJdx8dTcY67Z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ebbd325661f640b3180eaa753260cd9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
60a76c522a1595d83c7d7110cac898d5

SHA1
dee2e6594a182b3722aa4d033e12e8758c8d61af

SHA256
c6cbb378e32d4526cc6544414105f6b409945deaea5690bf0926bd1d64d39bfb

SHA512
110b8be0be807d85d5b867bbc0be866b08c44418d9a1f8b46fb97f7a97392aa5529b5eddcab27bda347c86375d190ffb33f622acd1d273ed3819860187d54910

Download Submit