f9fef8e4018f82e7ad7a18546d8561cd14ab99cc2a53adc93636bffde8f69be4

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a367155bdf4494452d4999f960ad5e90_JaffaCakes118.pdf
Size

74KB
MD5

a367155bdf4494452d4999f960ad5e90
SHA1

f62f3c459e52e9e573d36b4c103615ba3574973c
SHA256

f9fef8e4018f82e7ad7a18546d8561cd14ab99cc2a53adc93636bffde8f69be4
SHA512

71de97458100d43830f0c35c8508e40469e546c3a2429afac490a315bd2410e1c259f6ef48bdf959d77439723ef627a788a310183c3bb6eba2409f9aa66404f4
SSDEEP

1536:86ZrSoipqhLQhfC3CLaNdd777NFzvoLRzVKAc7be0gE8WapOtQHW0JueJX9UWk:7rNiWQhfC3qal7/NFc/DcPeVEttQ1w6E

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a367155bdf4494452d4999f960ad5e90_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
516b0bd10cafe2a59045bb9bc825fb81

SHA1
c3715a7be6489204798058ed1427767ee99a2123

SHA256
09589862cfd01bcbce91f58793633ba8855d82a7d22a49eedbf3f3f04acf04bb

SHA512
ed997da6697b273ec73126d4b67d33255ca5247cbc37da13ec368418a5563dd50b053449122b8a73f73d125cf9a5b653e64e73431e02aed6bfd33cf1adaeda64

Download Submit