2239d4daf943375c572054448f53752e3ae9bff3a6a9291bbbbd108a07fd268a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7ba3fde14800868e10ddd0c101019c5_JaffaCakes118.pdf
Size

81KB
MD5

d7ba3fde14800868e10ddd0c101019c5
SHA1

b6671aa3fefe9053d44590f92e444b53344d2250
SHA256

2239d4daf943375c572054448f53752e3ae9bff3a6a9291bbbbd108a07fd268a
SHA512

1f1660bc5a634d8b3dbb115fe0c876f9739b97061491ae86acc5a1e10f2110f652219af434359b510e93b85502ace74e4d6d149223ab36c58cdf6ad05a0f1e8e
SSDEEP

1536:oQareTTII4qrKs/t0etAAj7MFFHiLRyMs38Ahd0r9CXZbGw:dTIr63SemiMFFgRyMsMAX0r9C/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2356	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2356	AcroRd32.exe
2356	AcroRd32.exe
2356	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d7ba3fde14800868e10ddd0c101019c5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9fc8cfb7c52c1fd79f0e297c23b0e177

SHA1
78b573c02ba35e0f9c578a3c66991c21f95f4edc

SHA256
e096ba30b96ea6acac5078314e2a5092e0824f113b14f938da28f7241278b0d9

SHA512
0cabfcdaec1e0142a2e545ff914547adb4e13c4e4536c02e8008a50b6a260f34e219d3d73b7029a43f05a9bae2de268c371d120e9c2ba2ff04d94e24a694f8f3

Download Submit