0bdda2609b08785c9371c1b43cb61966fc87726466c6816088e89832584db61e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

108df59a61174093c2022f9416d79b89_JaffaCakes118.pdf
Size

88KB
MD5

108df59a61174093c2022f9416d79b89
SHA1

cdeb43894c9fdb9be4c26886c091ace11c418240
SHA256

0bdda2609b08785c9371c1b43cb61966fc87726466c6816088e89832584db61e
SHA512

ef058e2a323879b05d27e58066a7b432b9f3dfea6afaa93b17bb89990da5e5e86ecdd39caf282502d635bf4a0bc5a451beabe86fbaf07c597f22084827518e8c
SSDEEP

1536:2lNuWkjj3MRE7eshQtoV0CFk60FwfgEz+EIyarrTNHgC0QWOpOwrKWqBSegsOnHe:ITy8m7VhrXFkrFRFEITrGC0twrsgeKHe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\108df59a61174093c2022f9416d79b89_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fc54bf0a3fee90ee1fc99093c4a83607

SHA1
48398c3892e60f20e52d3892c690fb18be5a649e

SHA256
b105e3cf1b6e620c11f0d9f28104f7b06aad43e08cd20e337f78f6847b4081dc

SHA512
fb26a1f6fe64c92c59e55b136cddfc1b1d118792e4fefe38c96788b5482c4286c7641dbf3da4494a74b334a6b25bb8e1ffbe93f73c70849cd808b11b0b7cef03

Download Submit