2851989a80e8cda667910dd77d31f9406c631fb73bebced1f6bdb5bca9eb7afd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11f6dc0707308007076480e55c440bcb_JaffaCakes118.pdf
Size

70KB
MD5

11f6dc0707308007076480e55c440bcb
SHA1

f830b3d6106e21f0303a830ba0fc551b1cc3d3ef
SHA256

2851989a80e8cda667910dd77d31f9406c631fb73bebced1f6bdb5bca9eb7afd
SHA512

1aa32a6e15f874abaeb018dc79b0ac86e4d1daa5b217eb7de055dba630045fa8402b6e9a9235b25f359ddf9d2ca474652b400ad1ec12ca49d8c8d20ceb184d26
SSDEEP

1536:/vWQKe7NFdbVE6HdBt4zJbJee1PJVgrNFLh6RfoyXZX61RX7GHGf4BN:sSx3HdB0JbIe1hVgrF6BvdICHG6N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1796	AcroRd32.exe
1796	AcroRd32.exe
1796	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\11f6dc0707308007076480e55c440bcb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b3c55955480e3235c958141e69074aee

SHA1
0b62cf2b50f47fbcc1b16bbff214cca69b7de52a

SHA256
21020a14ea9f169107e4bba64f64a82ff4a0a1e126a5f9a2d2e07392a757e7ac

SHA512
4af723b18dab9e5d7fba741345d05972076eb4e28168129e0d50f7b5f2e08bc69cda594ced6ecaa5a20ae456e55dddf57992396ae4744d9e00f4901ebd4948c6

Download Submit