44b1c1de142a57bd5a6c077a6e95fdb1e1558f07012781b1177bb7dfb63c4461

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e778520649239c8c0544b95952ce8cb_JaffaCakes118.pdf
Size

97KB
MD5

8e778520649239c8c0544b95952ce8cb
SHA1

e6124a3406e083cde2e782afd1d95f70b1965208
SHA256

44b1c1de142a57bd5a6c077a6e95fdb1e1558f07012781b1177bb7dfb63c4461
SHA512

191b95821586728479fa71c79842ade2d17c7e87f2c8f6fde1ef60ea36c08afd9db2ea9dbba56158c6d04d6b8c2d269d53fa45eccceffc6170e9f6d2d680d17e
SSDEEP

1536:AsXvBAJzV1Mp0GAPs5X2EYWOOHhHcw/btgjgB9ViJo6W7LZ9Wzpw1ASTW6pOu2/x:dSJ3MpVYEjrHlcwSwRUeJYu2/1T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe
2716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8e778520649239c8c0544b95952ce8cb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
acb2676ce99dc389ca643542e542517d

SHA1
b0bee4755dd3bc2d0887133f4f21d8da39afc561

SHA256
4b8f0a3a90b1f72ffbc56bcfaa29a195002d39d7f6dc1df4c3c49ddf2a47f8ad

SHA512
09e97ce82fda3a577bc043915a0e73695a93d73066099f680807dafb018b5255abd6802f29d058e299aa660e3c9ebd9cf963d4e8ef718f9b62d5d40d6f6a06b4

Download Submit