afd5d26433735353cc3f80172e889ef1445306713f21526e7b406a4722f4a835

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93d84216459fd4a3c21fa7195daad96f_JaffaCakes118.pdf
Size

80KB
MD5

93d84216459fd4a3c21fa7195daad96f
SHA1

38176ce3598bfc9221653e3b4ef9acd42b7c140c
SHA256

afd5d26433735353cc3f80172e889ef1445306713f21526e7b406a4722f4a835
SHA512

6f02408bd91ea0ca5b640e3c9b77e63b627550dcea584fab0bb9f53b893d35d22a1c55244904e2631db66cfb2d524eaeea363f7d13526413b9c310f8fcad53b2
SSDEEP

1536:StMvAw/RgaGSO0Y0I9v9p4jRFlGSaUkx1eHHcEG/xfhJMH//g5u/qbuWxzhfQtG/:THgVb9paRN9kx1y8//hhJs/Yk/qbDVf7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
988	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\93d84216459fd4a3c21fa7195daad96f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
349fc9dd15cf95a537abfae71feb6979

SHA1
375db3ff94ed2d60b553945cb41200171dd7e36c

SHA256
f99385f031d3c441203971bb2cb0a583b1da5ca4472be0b5958b1897ebbf1334

SHA512
bb24b1a19e0ad056c847cbe1f32050ec15576163e727cf93b3642f19c7ff04c2497983f3c8cb92247b20a79d62d35edb97e06dc186aa77d79474928e704b66ca

Download Submit