a296276b9670cbf3b917be57be7a86666508025315669a5c8efb31ea8c24d59e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

841f806a1390e56270ad7e28cde61d67_JaffaCakes118.pdf
Size

45KB
MD5

841f806a1390e56270ad7e28cde61d67
SHA1

4ab1b77536d2888ac58c6f535a22023cba6254a3
SHA256

a296276b9670cbf3b917be57be7a86666508025315669a5c8efb31ea8c24d59e
SHA512

83d84c1d1e032deed0744899677e835836263500d46d29ab392695b5614e5b2ec3c5963d19a44a4e377620666989ea26a03766e70c70ae35f69e683dc7ebdf1c
SSDEEP

768:fgGzpD8ls4n9gIsNGJYaLuuGbVIHQVmhlnFiKf2l24dBvei1TjXlPWEnt8OR:oGFoYpmMbVIHQViNx4zvDTrlPzt8OR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2516	AcroRd32.exe
2516	AcroRd32.exe
2516	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\841f806a1390e56270ad7e28cde61d67_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
967a5ce869a0fff53560d92379b6bf5a

SHA1
aa14c9d2a4c69f5d45c1eb9f789ae1c19e82f960

SHA256
052cc8a14dcb9dee245f7700a5bbc8e9e90089f2b098d5c6ba033cabe041221c

SHA512
2afb08e4cb32ec7c6e4ecc1a616aa36d9f923e06138e8b460acbbec868ed5b298c05f4b54d7cb36134f7232428096b3f4b6ca88c76aeb04bbea42188731beee0

Download Submit