89b0be2649d5e421179141fbfaa741ea588e77a690a3cf1a64644b7710f4e81a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39b0f9a0049cfdb19685e3e57936b4c8_JaffaCakes118.pdf
Size

88KB
MD5

39b0f9a0049cfdb19685e3e57936b4c8
SHA1

93457074942c0a7f29178540a628cafccdbd6954
SHA256

89b0be2649d5e421179141fbfaa741ea588e77a690a3cf1a64644b7710f4e81a
SHA512

e1892e473eb6ad6b98127c65bec665261403c6f76dd33bc10f4e6294b570952e3550938680fd9d7f7b4356a3474e00e1b239cc26018a45d941248ac145d637c9
SSDEEP

1536:8dbDDlNvEu5Qm/hY8n92Rg/i1T8iuv1ejS4sNipEBMj9yNdH95m:sDlaaQwsegu1AS4tYdHm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2948	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2948	AcroRd32.exe
2948	AcroRd32.exe
2948	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\39b0f9a0049cfdb19685e3e57936b4c8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30f30e5aa8a559b8d33cc990614adf60

SHA1
13cb998e387dbe7430dc199a72da20f74461c9e0

SHA256
3674580edaf9dabeddfcf25eccd367192bb29ff6ec9f3a47f8fec3dd994d8cc2

SHA512
35ef736d7c7d794a3b566096f2d0098014f56f53d1410eb06786b192ba072d272210ca27d5b8df757943930b688bc3c24b5a28a17d47d2bb19ccbe209d2d2743

Download Submit