8d2d55cd0dc64bb7933595393374db28c04b5d00adac0f027f539ab7c5c8aa4d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ee803dbdcb60a1f04f04c4b02715fda_JaffaCakes118.pdf
Size

86KB
MD5

0ee803dbdcb60a1f04f04c4b02715fda
SHA1

3a211df601043e11656de23f0748184694e1087d
SHA256

8d2d55cd0dc64bb7933595393374db28c04b5d00adac0f027f539ab7c5c8aa4d
SHA512

0d3fb70b55ee1c9e80bef71cb07f73a3f1f3c1b3a7708ab320ca84e2fc98bb62d8e064f1f9b649d3ce3dbc24300ba3e2ac228f45aa6125cdf753e8b61570517a
SSDEEP

1536:mZrQBMMmg3flypg3Ys6S02QtnYpfNi8o8KWkNpOPlOhPdWerVXRhBkaU84Zr:YvM9dy+3Ym02Qx4fNi8o8PPMhP3rHhBO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1960	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1960	AcroRd32.exe
1960	AcroRd32.exe
1960	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ee803dbdcb60a1f04f04c4b02715fda_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cf36527158092d9260def9678d29367a

SHA1
fcce811fbb1a5576a83ee7213c72b2b76f381543

SHA256
1178fc927443989daed0eaffcd8490909d8418f49b775871134dfaa8c1ef2450

SHA512
cc48050259a0196cda8a80b4f3b63a3e334748b412821c7af9f147fb54724d76edd6c05c13ace01e4bdcc75443bfc2687af30fe200883bb30ef5d7cb0f756721

Download Submit