632cc01806c2d8eae85e699bd7e8735af7bcbf0abd3f149e7c26710ef250ddc5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c0db4c4fc1bb8637a375ff6e7d7e4a5_JaffaCakes118.pdf
Size

45KB
MD5

3c0db4c4fc1bb8637a375ff6e7d7e4a5
SHA1

86e30ef9fd5114aebaccf46b8edbb5e954ea01ff
SHA256

632cc01806c2d8eae85e699bd7e8735af7bcbf0abd3f149e7c26710ef250ddc5
SHA512

88b8ff1f3c425750c50ed965e0ce530f1c0edfd606b8ce71a6c8050011592c793e59e364155b9c5a2e8417c0d43418582fd2b02edd87316787571c7a15ec82d6
SSDEEP

768:df0WQla7s+O0SWBndDzqmizTs117Cp6bKv+Go7y5Fx06JvRLTucm9Ea23ItOM:lIysQgJTW1Cp6bKviy5Fx06hRLTuqa2s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1560	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1560	AcroRd32.exe
1560	AcroRd32.exe
1560	AcroRd32.exe
1560	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3c0db4c4fc1bb8637a375ff6e7d7e4a5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
58afd10d884662c59cca756ff14d5270

SHA1
cf9a73279b6eee834ee37a47198c450643d80eff

SHA256
281ad548c0060db8a054d4da481e5c60bc67340c2621b3f417b8f762d9412a7e

SHA512
271db47c212f9746dbc4ea7970cf7aafa28f9b84e8498114e283957ba845b0d02f6b0168b3f4d9fd3b8eaa415660d8953198adc130286ed40985992b37875e31

Download Submit