b0d79a273aa52b87138d4bfdc735705b5858a7f36faee99c1820e358001a08da

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16a0592bbe3a5597aaecea4730129e8c_JaffaCakes118.pdf
Size

104KB
MD5

16a0592bbe3a5597aaecea4730129e8c
SHA1

bb9ebb053f61298c5df873f1a47570f413a354aa
SHA256

b0d79a273aa52b87138d4bfdc735705b5858a7f36faee99c1820e358001a08da
SHA512

ca073ae50f2b83c9fb957c730315fa8698ccae15d00de133b3204aaedda64749cbca5aef3b23e2dea59570c9268b9a33136e3e4e2bacbb9d60f0c9af058d8089
SSDEEP

3072:0yC4V/1cZgzBUEra6vaJoCRfv0Cc48275mGjPy:f1ca1Uea6vgRBhq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2748	AcroRd32.exe
2748	AcroRd32.exe
2748	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\16a0592bbe3a5597aaecea4730129e8c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7d16c40addb47f5db8a5e90ae3366bdb

SHA1
4e1584f70a05f8c4dbb88f4c9895569db49fe19e

SHA256
78cd9662854c7f27241d9c14c9619ca76faea4a0e6059928ee8dc6731814f456

SHA512
e9d4168c32f0c1af63adb585c98f5962bc008bd28d009fa63f2fd7ed5101eaffc059eab387ba9e24f2903a377e5417dab7f35fce8732662f6e9a4e9833d97c46

Download Submit