08cb112d6711871d1fb1a6b0eeac1a74d103201e7af1c998b0251c53885dff66

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

157d237484ebaffa229c9d81813e379d_JaffaCakes118.pdf
Size

69KB
MD5

157d237484ebaffa229c9d81813e379d
SHA1

609c062a54cce21d06964c23a6bf4348f1a4dbd2
SHA256

08cb112d6711871d1fb1a6b0eeac1a74d103201e7af1c998b0251c53885dff66
SHA512

91a76d7a6c0146147e3e022ff99493afe323b185d6ed05fa360d7b94d4289cb04979af17fa067e544b6109e62d06e06a725e84989fc582e71ea15d7889a41b85
SSDEEP

1536:lW7Mo+OXxr3KVXql2ZiUjfp0WHpOvruLs6W4xOjEcOgytGU:rOxr3KxvUUjyv0s+xtcOh7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3000	AcroRd32.exe
3000	AcroRd32.exe
3000	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\157d237484ebaffa229c9d81813e379d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1cd5bf1e731ddbad94dadff4de068d0a

SHA1
879f6c3b85ab107b700835480162f231f7047e47

SHA256
fffd982644011f184af2bce6dc0bdf558f697f4f5efed5148ac4a486bdda45ff

SHA512
3fcf39c4ac11fa3f64df8108399a7f9fbd620527d4b618f90fdeed35b08de1c9a1dc138c3103abd5bd0125834a714403a2055e56c09c123fec964ca761159c84

Download Submit