062ea69ac72bdd164061beed6cd5541db7637de62d42c7ad47cc166fd8d36017

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cac4eebb29915bafe252ee47348cfb8_JaffaCakes118.pdf
Size

71KB
MD5

3cac4eebb29915bafe252ee47348cfb8
SHA1

ff12795da6438fbd29c15db0a40b892970d102a6
SHA256

062ea69ac72bdd164061beed6cd5541db7637de62d42c7ad47cc166fd8d36017
SHA512

b28af76b23bd2d84111c9e227d78d356d09f00e5130a2a88358bc6e4116ea7d3707e444319ca7c6e2e792d2c6ebf86a3fa21aa8bbb994c5c156aa9920190c9ab
SSDEEP

1536:TnKbPaEzfAu1oD7B0NAA+2tIWWUqPXtBDcK8ZW8pO7kmp:/GfAu1oD7BZA+20UsthcK8w7B

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3cac4eebb29915bafe252ee47348cfb8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0c9ebaf0577c41861c9ce215812e73a2

SHA1
67a42fc3168c8cc4a10a5605dec1b5a79a998c65

SHA256
c5ab71568d455f4836e10db54b6ffdf099fa4072888f173049b92a8b1dad588b

SHA512
306e949141b18c219448534eecc199e16259a308919863267443976b36c1df207f8088aa10dad478ce9b867f1e2c81b9a76e8eddd5dfac61775845c02e96115b

Download Submit