388d77069b5f8693ba3c9595b640ab7c40234dcc5ec671d17e1b5916b0b92069

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ddea51acd851ef13050ecac74ffea6e_JaffaCakes118.pdf
Size

69KB
MD5

2ddea51acd851ef13050ecac74ffea6e
SHA1

988355412a12dd1f6a7de5b3a9826b909de3dbe6
SHA256

388d77069b5f8693ba3c9595b640ab7c40234dcc5ec671d17e1b5916b0b92069
SHA512

c36ebc12f645ebd0164c3d5e40913ef0972b252f3467029c90ecd60d2bed1c45d2f7ab022e22fcd2634212241f710bcbb38957ef0ccbf702b1e74c4ccbe1946d
SSDEEP

1536:612LKALEiW4GKhbJs0yslfAEVz4wnYXW3ew3BPxi0eew15:ciKUnWOhby0ys6+z4quw39xex

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2232	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2232	AcroRd32.exe
2232	AcroRd32.exe
2232	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2ddea51acd851ef13050ecac74ffea6e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a19965fbb2f368fc65cdc06a577cec03

SHA1
47084c3e6e9e0b2f510f193713bc33898637c911

SHA256
896bb526da97721d0648a4118b7a11257deed77e622e9946b3eb2a3268bc9705

SHA512
f299b267b2bde94676a9a68e15932b0082dc46656b556411e32b437cd4621e042af1e4385de009fffea93136688201c259517c866fa8f6ec580b5b035575647b

Download Submit