405709c8c80df677b67c297f85b92fa0a9ef60bc14d6b4201944f55b9d5124b2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c39889a4beec1002eef548d9390019e_JaffaCakes118.pdf
Size

99KB
MD5

2c39889a4beec1002eef548d9390019e
SHA1

69c2f56abf66210b411b9d9a42d454c15f1876d4
SHA256

405709c8c80df677b67c297f85b92fa0a9ef60bc14d6b4201944f55b9d5124b2
SHA512

94f82607010d2e4c1c5ecace469d36c3e1aa26cd31be8205beacbd92de0ad6d6d02b174c8c1cd106592a579476d52ce8c6f7cc30167cae4cbef50386acb378f3
SSDEEP

3072:C2n9HvLFYHehTPf0kPyQRS26cihgAOT/aK4:CSBYKDQ7ke

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2060	AcroRd32.exe
2060	AcroRd32.exe
2060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2c39889a4beec1002eef548d9390019e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
44743a7d9d23d4e794b0d200797af997

SHA1
56865a8ded46b325b9a9a8c4b412e7d5effde63d

SHA256
991df303f84f8aedddb8802aef9c1e5f4c9eeaa904092e0164b1b0eccd5ae9e6

SHA512
2ae3d173199799700b73f191e1b14f779be42ea6aca236ecc5121e557a237244fe007d5980ac58fe3aa9317164a2c6368ce0dc3974deacbd0fab470c88ceeec4

Download Submit