1eeea3ef6fd2b9cb46dec3732e51ba7b8ba5f06ff3e3bebc67606fe205957fa8

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fe64144fc0c856c3dc2f03c66df8766_JaffaCakes118.pdf
Size

99KB
MD5

0fe64144fc0c856c3dc2f03c66df8766
SHA1

03f24021f1a390dfcfa81f8c6768fcb1ff6d1ab7
SHA256

1eeea3ef6fd2b9cb46dec3732e51ba7b8ba5f06ff3e3bebc67606fe205957fa8
SHA512

622b5ec25eec1cc8767b40afb02c33a3f27cc4f1450e3eaf15bf9f9e72547c2ecff77287e7fcfae3679d4f7f12a1d1a409febebaff420e707acc9998c3bf8279
SSDEEP

3072:JKeZTEkUyGdy0i1cOzigSxNBHVIH4W6yMjTX2Knlxz0:geZTEkMHYcOlwdVIhCHnlx4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2328	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2328	AcroRd32.exe
2328	AcroRd32.exe
2328	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0fe64144fc0c856c3dc2f03c66df8766_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
88d00f3126bfc20fd40d08864a752a93

SHA1
c170e6b2f942443ec4abad0999a444880af03b9a

SHA256
426abadbab838d6ec13c0288717d064e59505b427e0bc72ccb61509ae3aedb5c

SHA512
359ac191f2cf44cf27e9cc8e1fdaa75f6a386560be0dc793c9db0eede9ed138aefb0ac58b0b69f5c3351be60442ca04e217d9da9800203eca366d3c086cc3ce6

Download Submit