b956daf5d23da83399c9aa1859bf4943e6227b3cae45e099aebed4ce000772a5

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2427d3352ab5dc2433469dd3bfffd34_JaffaCakes118.pdf
Size

34KB
MD5

a2427d3352ab5dc2433469dd3bfffd34
SHA1

f2889dfce173c85e23c4fb03cfbd77e88f2bb228
SHA256

b956daf5d23da83399c9aa1859bf4943e6227b3cae45e099aebed4ce000772a5
SHA512

21a584768a599bb6603100dc11dc0f6236f2e44c823e9898821220ea35abb3ab71d152212385c17f2c9f50fe2dc7e333be542716ac7738657bcf18f7d3835959
SSDEEP

768:KycMgTdkHlz39Uf60VhzJcE2H+ga956fjA1FgWvPL5VKu:Hjghk59O9VhzqE2H+Z9IfjAjHvPLTKu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a2427d3352ab5dc2433469dd3bfffd34_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8a1263ac5eeb0be063956b69f14292b0

SHA1
7331193cebcd7a6a56ddeac60e5ef652f73de48c

SHA256
90832fcaee9f23a2499d3debff74079f6e301296469cf28f6b2fcd5bf58d1498

SHA512
ec98e57331344e9b9d6002c5e927c49d037a09b8fc6a4ec41473681ced22f44efc6442b0e8ed5ef92ea7334303f24796cc0483e29033d699bb88d16a096f102c

Download Submit