cc720fad190b29cd98a347ed390abd6d24111fcdcb35075d1c9b82f505cd5b67

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f28fa167c268cd32ce72423113ba4f6_JaffaCakes118.pdf
Size

91KB
MD5

0f28fa167c268cd32ce72423113ba4f6
SHA1

5b2fb0953813f181acc4fb7ba1db0f31d28e90cd
SHA256

cc720fad190b29cd98a347ed390abd6d24111fcdcb35075d1c9b82f505cd5b67
SHA512

29814d3aea0ab1b05f74cbd18079b0095d1b5652727686b687da1e254b8717f01a51f8e062172353f34531643ba0fad6a2f8354710cd97d003d043cd760b0948
SSDEEP

1536:qnopEE7ma2T+I0XRMivLNHemL6MLOVyYga2KyXtRJidM8H1+7NwYy8OmTnWSDum7:Sopvya2wMiTNNWGOVs9tRJcDkrb1Dum7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2972	AcroRd32.exe
2972	AcroRd32.exe
2972	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0f28fa167c268cd32ce72423113ba4f6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ce88ff404fb554fc9a2c0ebbe2088730

SHA1
2f86560c9b7414e2c40b72cab46c595fd0a25674

SHA256
70089adff6ede6662cabbddf88ad9b83a23814581d6f21c8c1013a32cc9a5f0b

SHA512
6d972044a92c3c7f969bb3862854c42be531e4edc5dae187c41c10593509c3d776823a2d1d7c5a433c9256b5938a3b965edd9d3c19c18b2057f10f3518f72d12

Download Submit