53fa0b3708513847037c6df30c231a9296924e231d017b7f445a47c6fafda46a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2ac79c30ef7977b5dac3b8e4b0d2936_JaffaCakes118.pdf
Size

80KB
MD5

a2ac79c30ef7977b5dac3b8e4b0d2936
SHA1

32242fc388a1d1e909e287c710f04b2748d4aef0
SHA256

53fa0b3708513847037c6df30c231a9296924e231d017b7f445a47c6fafda46a
SHA512

906300db89a222233eeb526e2f33fec5bb743db940c3fc1307f0c5bae2799b7055958abacf07492a04877bfdcba7f6790b792f42a7ea05b2b9a9b552390344a0
SSDEEP

1536:d4c2WdXykdSu97d2bgJNIe661jsB9wkhlOgD6W6pOu23iSgW9Ob:ac2Wdh5d2kJNIe665sB9wkacHu23iS16

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2408	AcroRd32.exe
2408	AcroRd32.exe
2408	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a2ac79c30ef7977b5dac3b8e4b0d2936_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
05a20427453f2624eca37c35432edc46

SHA1
9f71b9e25c85e78f20a444ca45101f2c182ad027

SHA256
2cabadc2ec77531d1498bb83e3683e748eac4c8bcadd4786e66d3ed388f84027

SHA512
3ebf9f19f06c80fd131e3b0ded1d4add6a79417783b43d1287760a7a9f326405de97e469b3858329d7ccb4eb96beb1603aa639696f2874d65de31c5de001fb16

Download Submit