6ef569c8c81527691e18ea99e8d4cb728407270318ff27e4bb2cd2f99961a4dc

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3cbf6985673dbb863b3a734ac0687789_JaffaCakes118.pdf
Size

83KB
MD5

3cbf6985673dbb863b3a734ac0687789
SHA1

3853d109caa0ba60e59f444ff7360b328550cb8a
SHA256

6ef569c8c81527691e18ea99e8d4cb728407270318ff27e4bb2cd2f99961a4dc
SHA512

a614232fc83882c19e428fbc3e4cdea6f13888ce9e4498d882dac03521eee79ddfc5c514c3197ac4af9983ca1706345d1a7409f20c80f8a8f8103deda957bf9c
SSDEEP

1536:r98cARnK+WJbRakHbAsoeeTObugIylkpaEBW4zE9RyDHixWCvgIQWQpOCYHfk:xgniJtXdBiI2a6EXyDCFgI/Cx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe
2684	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3cbf6985673dbb863b3a734ac0687789_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f65a037bd04222b38a1d732b0485eaac

SHA1
d0e1bb72e21014214a5cc70b45731fac9b95f8b5

SHA256
a64b012e8a41fee00de30afd0d947ed07a5528db0f247453a236dff3ba2fe854

SHA512
6b762a874675a6a4e28fa1723bf0194507341c4e3cff4e78c19a1a521d731db0f4e644c2688b7c681b552fcb81e5eab040f00388181073823e8e2892694b4191

Download Submit