e3768ca43e152e697e6771589375bb2cc23a33611559706430e908f4b7821fd3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3099e1919201028681d14e18b01deb99_JaffaCakes118.pdf
Size

48KB
MD5

3099e1919201028681d14e18b01deb99
SHA1

220300d6ded615b1ce20d1745498d62048b5b319
SHA256

e3768ca43e152e697e6771589375bb2cc23a33611559706430e908f4b7821fd3
SHA512

ef0571f627580d078937ea52b2a2b0526ab074224159c5e783d7d940ce1cc6df12f0ddeff995ea4cc8d5f9d5c4537fa3fed769e8dbb8e6432bbee89af892149b
SSDEEP

1536:M/mnVeno+2rNdcNn+6aApZqyn1aApZq2Tg:MunVeL2HcN+6Nn1lTg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2764	AcroRd32.exe
2764	AcroRd32.exe
2764	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3099e1919201028681d14e18b01deb99_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bcf218b894257b0d61096da9ecaef4b4

SHA1
abb7aa5af3b1d0b69461d3be705f7d8d8fb0fa9f

SHA256
f4f6655858322adb3f53287cd95b82a5be3bfb5dab9202da37c062f581f9a29b

SHA512
373f1250af2c04b2dced26bb1b53f5410718b1637d83709c2151630673687e862f273b592b4eca485586f1ff0cad5e83bdf2769056683f7247487b85ce5b3aa4

Download Submit