9e01a13627670c6b6d24cbf62551327c17ecbd28263fd4c49cb1800690c17ed9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38d56e946aca5f174278d21521439a10_JaffaCakes118.pdf
Size

70KB
MD5

38d56e946aca5f174278d21521439a10
SHA1

86e2440521f1a893f865d1311f308cf82ec890d0
SHA256

9e01a13627670c6b6d24cbf62551327c17ecbd28263fd4c49cb1800690c17ed9
SHA512

965bb1f6916e92ee3ec481386dedca8598670a055319124312aac905b53bc35b741e9176f7722c383b1d8fdeeda54dfb7be2d3d2e51021616a9d822b9264ab16
SSDEEP

1536:prvY2iYNv2ggHVSHwbdGlfHEhr2WxcUQ6gx27W8pO+NGnNTtOYL:Yr1SHwbMtkRjcggx2C++xj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3068	AcroRd32.exe
3068	AcroRd32.exe
3068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\38d56e946aca5f174278d21521439a10_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1d8bed915a5b2fc9902a084975536af6

SHA1
f78a76fb92d1ae4708849f6392299df8b9084453

SHA256
7ab067e90a7fca967ef798eb2059b0c2aaf9cef8176ff5ff3823406a36f317a7

SHA512
120c535af896550fa68dae1cd163e03faee1f890e9353da28df6c5324509d2667470690e0ed8d5fd727f01ae655c189064b217085baa6fe0b154a1561f5bb0ff

Download Submit