3bef43706a82a21379a35b2ea320ac379e8140627d9ea3908e0152c9660eca62

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

169a9367bf85ccbbda4dc633b5209d3e_JaffaCakes118.pdf
Size

104KB
MD5

169a9367bf85ccbbda4dc633b5209d3e
SHA1

6dbbcbefba9a56b722a1d21f741f81707827a40b
SHA256

3bef43706a82a21379a35b2ea320ac379e8140627d9ea3908e0152c9660eca62
SHA512

4b2735fa52bc646d396fe36fafeb4c654d2b7e9642af37e6e96e5b68e914c2cfaa1f7927ec7780791503c888749f7ea72711f40c13aa34b89652a1344ab9c6de
SSDEEP

1536:lzDdMzHsiZvaR3c0Awb4fShpE5Gdxt8OODqKGlMVEVWkNpOPWBy1xW62QYON/Ibg:x8Hk3PAZqh1RdlbeP2yHlhIbDk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1232	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1232	AcroRd32.exe
1232	AcroRd32.exe
1232	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\169a9367bf85ccbbda4dc633b5209d3e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aa9bd71617e002ca612bdfd0de897215

SHA1
9f22d0a790a685b84c3bc20237e7d7c75af6e8c9

SHA256
c46b2765f3bb203aa5db39760ec0657a128fadfa8b10665ba46a0eb453f8ec3c

SHA512
30298a241fc7786affbcf51a4c678e8400a7848294aa630e71cef50f05dc98356d234d82adafc3a4bf51d57491bf5958f10a7d878c5cf49f2717bc953a70a8dd

Download Submit