3c2ab2c62c54ff9234ba93113d06a2feb54454bc3742780dfa593cd23f93384e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10784a98da050c638561e2dd8425e40c_JaffaCakes118.pdf
Size

95KB
MD5

10784a98da050c638561e2dd8425e40c
SHA1

8a8ad816ab12fd1b231d9e73fb52b8f7831617b3
SHA256

3c2ab2c62c54ff9234ba93113d06a2feb54454bc3742780dfa593cd23f93384e
SHA512

91cdf34b90e5633fb6e10d9f9ce19637cd35d1cbd47df0e681f72a2eef0289cc7b1954c63a93d67ffbfc18a43112e804098fbf3fd61590c306db179bc8240f76
SSDEEP

1536:ZN72YMwXSjF9kQl7Hv3L6YTGa1mpfq4azYFe5NrJdTRjsSxitMTdqcVUndTWYpOi:WwXi7LHv3LJTGRC4azqe5VFsSxitMTdA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1840	AcroRd32.exe
1840	AcroRd32.exe
1840	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10784a98da050c638561e2dd8425e40c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c9fa02746d4ba2d85ae91dc40a942e04

SHA1
a82604c2dc9691e67cefe763e3b9602fbc1a54a3

SHA256
eb32194e02ed0ef82f457172891b40b49a37db3110ef1e681fe82896317ae3d2

SHA512
9c68eeebb42adbf514f7202a8479c3b0c2f65e35422db1d894fa5294640b53e608fe2127454af7369effa18f3053178b1e67075dd7df8e6093515fe38852da74

Download Submit