585b48b1575f11b7a6bd921b0bc2f6a2b468887bf47d40608fca27de56e148a4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa81445e8726e45ae5d2ed3171dcd8e8_JaffaCakes118.pdf
Size

76KB
MD5

aa81445e8726e45ae5d2ed3171dcd8e8
SHA1

2c5dc6d31897b9f10f0164ce354812657493bfec
SHA256

585b48b1575f11b7a6bd921b0bc2f6a2b468887bf47d40608fca27de56e148a4
SHA512

979e5ab77d68e911044c4d997b618231f6bb6cca372593843be6cc3239aac4f07da665e1f510cfa94da21bc1b20bf36bcbbb64e9e40a4f77486f946ca82645f3
SSDEEP

1536:jhWuqIZbV4GQQn7kSbuRizpm+Zi2LAxc2SRm89y/W4Jd4E79GWcpOmFTRmq:9WuqIhV4rQn7kSb1FZija9yLdt95mr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe
2556	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\aa81445e8726e45ae5d2ed3171dcd8e8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4e9b40b38ca2b6c429ae8163cb467d4

SHA1
a4969a6c21bf991c706eec59bffeadc7139f8eec

SHA256
7bce1705c2d59517cf72243f1ee89270bbe3cdc3f59a01aad18563982c694c90

SHA512
0a8837ab434fc5ad18f70f6ebf239d802b60dfb8c9a788ef1daa39c18707933a2db1e448f08974c3e1400c2cda8972e9597ac25126a30af9d1fa2075335832eb

Download Submit