1547c236b0474d4bf10e91edc6af10a894b867da24b29f26b29e0ac408a434a2

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

107a8bb98e6b96feac1b0dc337016a49_JaffaCakes118.pdf
Size

73KB
MD5

107a8bb98e6b96feac1b0dc337016a49
SHA1

8efa61ba674746fedc32cd5744686a6a5fe744cb
SHA256

1547c236b0474d4bf10e91edc6af10a894b867da24b29f26b29e0ac408a434a2
SHA512

673267ec822a8e9576ba3c6960f45dc10dcb7c2e2c272b1b8582ad739d647cbcedf9a844028d1b54e55911ce91a3ca7a85c800af47ac7b02cf1f0469bd2f68bf
SSDEEP

1536:n2HLjX91cpdu3Ejf2NHeGWdZBqPoBnO2VfzLGr+o5YIQad7n2UniOEW:GXLc7eEjtdnqcs+ovQc72UiO5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1856	AcroRd32.exe
1856	AcroRd32.exe
1856	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\107a8bb98e6b96feac1b0dc337016a49_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9a56095e3aa5553057666d1aacab187f

SHA1
b1b1e3df11455327574384b3652853e067c97f41

SHA256
ab62bdc4e7dd526720cac759076ec68cedcf697a67a07091e728f2e22195f1cd

SHA512
0f9fcb74093b4f4eeace819483d63cce24a1f0ebcb5aa3193a3f8618e97c975c474b94da94a5f2d3bada0344c52b3cbf21c870c07dedc060f2b42fc8df1bb4f0

Download Submit