158ef0c30f739e7d7fee1db9f8de1a5010b8b6327eaea947cf444bf697baf441

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a48a203cf5377dd7da7f69572b9f0d0f_JaffaCakes118.pdf
Size

77KB
MD5

a48a203cf5377dd7da7f69572b9f0d0f
SHA1

4b87a2224358047a0d8815fa1e96a1788ba4f3e1
SHA256

158ef0c30f739e7d7fee1db9f8de1a5010b8b6327eaea947cf444bf697baf441
SHA512

f683f6224eb5b7277032f2561aed7f0048f46b11dd792e04a5f13fa8e50ca7212058abe9ac15d71e9fe77815d56225fdcae1aa6d5065f9c3b2ee6034f1899705
SSDEEP

1536:3KCsip5LrywTV48MydybYj5tu46+5gmCKtetsQubKBXz9ySNBoj2ZNaCIglQ:bsIjvXj64D5gmCy1X2N5yAB+2ZICIGQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a48a203cf5377dd7da7f69572b9f0d0f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c1f5957f22f93e70166fe5e962b6987a

SHA1
5144ab43f68637bd8e45933204234596cb4bcf30

SHA256
31a069d6d35be0f1ee654ae650db9b65551aac20f63b302256e92ac08c14c1ed

SHA512
674a8df7be653d498395f0ff73229dcbce39526547554b5db5f45f1daee49dab34d5d0d2116ef776109fd26e3e48c0217a01c94c6a942f6b866619bb2462b883

Download Submit