71774b087855ce6d4990814ce4b00588d4bae9c190cb88e29a14fc0406e1feb6

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ef1e754f5e729d03582c34414d1f384_JaffaCakes118.pdf
Size

86KB
MD5

0ef1e754f5e729d03582c34414d1f384
SHA1

3ff1bd8e785d637b1098b69a49da87f422ba069f
SHA256

71774b087855ce6d4990814ce4b00588d4bae9c190cb88e29a14fc0406e1feb6
SHA512

75b25295013b15de3b39c821741289b574f9f4de91adaf93298911a5b44cfe7e4b34078abd7b05e45d8075bdd34dea36279876796574d94d49462f39406a2912
SSDEEP

1536:H3bIR2AyCk4MixasN10jENyiCcwT+IjWlBn7T5XiRVsXa0wSFWUpO7dLh:Xb7AyKTr0bGh7NSRAa0wSo7L

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1916	AcroRd32.exe
1916	AcroRd32.exe
1916	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ef1e754f5e729d03582c34414d1f384_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
61f140da494f7af206d7c24d37015d85

SHA1
b98596dd519f30de7b6ac89168ac31ec7ebe8288

SHA256
ad56befebdb86dbcd33f480a91e22d862f35aaea9634e07d23641f778c1c25b0

SHA512
abcdc400323cb0f28be40f22e4a69355a05b092a4ddbc23970810e51a213714337118debec158ad4cc998d320d9307287817cc08ab6ae40e2ef97fd8d685cfbe

Download Submit