4b2b33a0e5aa76cac5a6465e49cb2a1aaa60edaffd681f04cce2a2cbf43782e7

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83d8d47fa0682a61bbad36bc4e85a7b6_JaffaCakes118.pdf
Size

75KB
MD5

83d8d47fa0682a61bbad36bc4e85a7b6
SHA1

00c1845a8ca8af424c3cd689fa241794ff65cab9
SHA256

4b2b33a0e5aa76cac5a6465e49cb2a1aaa60edaffd681f04cce2a2cbf43782e7
SHA512

9229f16986a56adf44b9ed827f91d2046035a43215c355e1c6cfa33d453e16114fa82faf747f27b3bab483aa85af5084865cd7c18796128d9359f6ea1debc83f
SSDEEP

1536:8CvpJbZlfRQZQ26FmkNAV4T1jPSuWGpOKFKwEQy8WdG7BzCN6OZ:PF5R4t6FmkNACTRa3KFK5QyREB2Nd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
448	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
448	AcroRd32.exe
448	AcroRd32.exe
448	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\83d8d47fa0682a61bbad36bc4e85a7b6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
81c65c3084bff3b948276ad30c81f5c5

SHA1
1d63588aed6a0631c5df8e916664c8e5448e2b2a

SHA256
ab2f38b924a6fe0d54a7c138efc9c0229e53c0dbc3288134f5af79916b83b229

SHA512
0786c842d626e1ab23f65322f3e1ca56ab72cbf70cdd0df0b252563e6d1aa8eafe890e293e1f66e43d5053ad56eb8b12515a72e3403ec65836d03146f4692bdc

Download Submit