d5d41d76ea2c490057491873aaee3e6430772f1ce57f862277459c66de469595

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a346946a089d4b556e17d48ab94c6411_JaffaCakes118.pdf
Size

85KB
MD5

a346946a089d4b556e17d48ab94c6411
SHA1

83d7cf8931f06ba9645b50f79cc2ca4461021162
SHA256

d5d41d76ea2c490057491873aaee3e6430772f1ce57f862277459c66de469595
SHA512

d8de3b22ff9da67c9908cabd7284be2dc2960084eb17d4c0920e7803aa6da79372db8b7757e3668566536492fcdd0ac5e21d03739aadc4603936ecac023ef7bb
SSDEEP

1536:dRyb2XwskvHH/wfcGLMhhyVBLKYbCi/WepOiCWCGgn7I8OE5tlwq:XybEwsS4fmhhyTK6CigikGCbD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2948	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2948	AcroRd32.exe
2948	AcroRd32.exe
2948	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a346946a089d4b556e17d48ab94c6411_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f2afb3b80c6bf3f2a6c062349d5e4fdc

SHA1
36e3fee993b2d43826dd5db913fd1262608d8790

SHA256
b47ff872f77f8c4cc968856472525fa05227a0117d67711338cd3f0b6e794953

SHA512
fbc7413b4713687974d69e994a277fd05c455c4d9b70fe097d196162502ff066fd6e344d9c4217eea09dcadf146c1c783486d51da4edd6f0b516a64f737f4c7f

Download Submit