8276d16c3cdbce06f0ca26a9dd14318166f1d87415972b6a927e1a5b3cc9de58

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fd7ce91ebbb161f2f84e918b53465c8_JaffaCakes118.pdf
Size

124KB
MD5

0fd7ce91ebbb161f2f84e918b53465c8
SHA1

1b6b612b02c7ea5f545ff3b52f37b6fc7a00c3de
SHA256

8276d16c3cdbce06f0ca26a9dd14318166f1d87415972b6a927e1a5b3cc9de58
SHA512

1a0e82697503c52708ae84ac6bdfcecee2f3a90f99a8d0431d25679555e5a25951de77751b765b61f899521fd1346b70339d2345a2406cf1c9d5596d5e85dc63
SSDEEP

3072:rQqDKrvypXG/wh/iTOGbEhzYAB2i5DgqAGRCd4o:rQqDKrQXG4/sDEhYSXs93

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2856	AcroRd32.exe
2856	AcroRd32.exe
2856	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0fd7ce91ebbb161f2f84e918b53465c8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9de3980663ca8a921ffd1c5080e76654

SHA1
8333aecff23efc38c9ae8137631bb33def37d274

SHA256
1c0dfc6c22fe14f110948d9e791835c3c843f4c62985bf011c32fd9a02db8bda

SHA512
b7f4a5d3a01c6a5dc7e79fd27808c1676dd691ec3c39e8bb40754fa21e16fe4e5da7c127167eefdef4ce6b3e363aee9b73aab859ccefa9cb0069e4d1d0db3b8c

Download Submit