41261f0d1f92431b50f27450700c87f61244fdfb32350b6e8b9bcc59a099e838

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ff19ab3ddec096356eb5be73669d332_JaffaCakes118.pdf
Size

72KB
MD5

0ff19ab3ddec096356eb5be73669d332
SHA1

93bce2dfd41405226fd08b615090e5a2fc7feb62
SHA256

41261f0d1f92431b50f27450700c87f61244fdfb32350b6e8b9bcc59a099e838
SHA512

21b73c2ad6def476cfb7b7a1de588b6fea5f57974cba26e01c5e877241d553ffdd7197f8bdac3c5ce37309951f018bbbb59a43ca06a4d9c2cbc1fe8288499c41
SSDEEP

1536:gONAnNjm45m4Ikw4Tsjf4w808hBVnthZ+aC4ngr//pYeXdjZIJdJ1fw:lcyd4Fyfn8fnthu4nI/BYe9Z/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2400	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2400	AcroRd32.exe
2400	AcroRd32.exe
2400	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ff19ab3ddec096356eb5be73669d332_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
61493be3c0dff03875a416751e28b2c4

SHA1
14761ffc5ec07c9c65f9834f3294bf32d05c3e90

SHA256
d7312b052128f02c42acad9ce990cc5350012b7a7edbcfec4d711c4738ed6c9e

SHA512
4ce910cf402e71e61e214d83a0c3fe80d6e03b91c8808cd541a87919db79aafedbbde0a0d09e3c8489521536a98c1ad60639934940b1c3e302ba91dcac5486f4

Download Submit