60f0cd212c20e92946791390be85f9a0cb021d56162ab921cc4ae23dee58519a

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b6e13cc27dede5e77540e50cb04d9b6_JaffaCakes118.pdf
Size

95KB
MD5

3b6e13cc27dede5e77540e50cb04d9b6
SHA1

67aac3cbab4b0b915f294802a35aec9d3485c2ca
SHA256

60f0cd212c20e92946791390be85f9a0cb021d56162ab921cc4ae23dee58519a
SHA512

bc996ba8740f5d9e508ad37b3233becdf6094ab0fa86fd84a7d68feb2e7f0d704194f21178a5e7674b308709bb0ff68a90c48720b94d97165a67e8c28927e101
SSDEEP

1536:mD+GiNzUrTtstBLYq28lNFE5sW6yIUexBxneply4qTbyXvAXZWn9b06BInZWbpOd:BGiNzmqtxYqjEt6yIvxepY/yfb06Cnbd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3b6e13cc27dede5e77540e50cb04d9b6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
60a3f07b313f892030e69a0e2319502a

SHA1
5ee625bdc75db6aecce15a5cc7c79c88a41d7b15

SHA256
789dbc52fed21dd8478ed9fe6817d53b22595557c432916271d4f88bfc4a1857

SHA512
ea4280b592549f3b33f6444936186d436d249237fc8b9f40884bf87d6213f84012e0d4fdb1ec5d91819782fbcd6d230459b32b3a0aaa6ffadec53cfe95997999

Download Submit