b5fa2c8a8e320a1e196e2e9c0f7a059e49fe2b004d70dcd30dda1069b8fa10d1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a46f464d4fb3e6c807cda1820975cdbd_JaffaCakes118.pdf
Size

15KB
MD5

a46f464d4fb3e6c807cda1820975cdbd
SHA1

b5011fddc5ddc471df96296e8bd023836a539a1e
SHA256

b5fa2c8a8e320a1e196e2e9c0f7a059e49fe2b004d70dcd30dda1069b8fa10d1
SHA512

ecaef8db334243fe85b199bc6d65f90d8f9f319b44812703cec98bf7f15aa59cb19179d3ba324caf74785d15dbcc13771c0f901f44df7d7882bf4b6c08c1b71b
SSDEEP

384:XP5uA6SkKAt4aqxDBc23Ri9kpoTvtS/yo8B/5J0Z0IJvkU8K8jlTLez1LYh:axiaqxtcqRicoTA/PWhJ4pkU8x2+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3016	AcroRd32.exe
3016	AcroRd32.exe
3016	AcroRd32.exe
3016	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a46f464d4fb3e6c807cda1820975cdbd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b6e3d67f69e1294bc81e4870ba210e8

SHA1
a46b412fd3060275a30280cab7c67d76bd661978

SHA256
16600b76d0ce9cc625d09a415fcfd024e97dbc4824ad5cb9015672d956bfbc96

SHA512
7661083b398302cce484369c85b73d478c34ecbce1941206d1a33acdd3b62bd34603be73e992e7af73575c6b588f5e87c68ef4e07dee402cb8dedb12373eaa61

Download Submit
memory/3016-0-0x0000000003F10000-0x0000000003F86000-memory.dmp

Filesize
472KB

Download