4a2d11690bf2b5bbda38f7b0ed7b6e44900560e9dd79c9f09be3c8f358efa44a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80340693c0481c74c3c75428ce28e93f_JaffaCakes118.pdf
Size

93KB
MD5

80340693c0481c74c3c75428ce28e93f
SHA1

b1b304453ad93fe1fd62e954a3601f000ee0b971
SHA256

4a2d11690bf2b5bbda38f7b0ed7b6e44900560e9dd79c9f09be3c8f358efa44a
SHA512

f351fc761d3b8ebbc70bb979babb6f02b6557c21f60d1d12654d84271a3eacfee9bb4b9d004536d0840653ddb165fe051c6015237168c055df46fc9ac101bdfc
SSDEEP

1536:G5d+z3FRwahYhc9LQN3ycGdQJWpZzsVqJ6UPwW9Q9bN6cdacWOpOaZpKH0+l:/L3LQNkdQJYcS62K9bN6c8ZaZEHV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1440	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1440	AcroRd32.exe
1440	AcroRd32.exe
1440	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\80340693c0481c74c3c75428ce28e93f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
37962b7870505a7f12e4af280aee5806

SHA1
ca72baba74d5be98093f8b8704056397f57ca597

SHA256
ddc299c761953c14f249034bec8bd0b47ed2568697e8c8ab5f816fd96bcff0e2

SHA512
6bc58616d77b40ec0d7e0cda76448d4922efb9ba2f1497564f66f5ed4cb033b65e90d734564702d00aca3acdf3c87ea64fef47a7dbe088c080eb1277abb1ce14

Download Submit