4594edc056af8453614266eec148352fcb09e12329a269d30f39808fa78615f7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac189b16f923511227423e54497472f6_JaffaCakes118.pdf
Size

3KB
MD5

ac189b16f923511227423e54497472f6
SHA1

7830e515b8f6413188bccb51d0d7942ce6b71e8c
SHA256

4594edc056af8453614266eec148352fcb09e12329a269d30f39808fa78615f7
SHA512

69905d971d2132ac04eebcdf584a08b8d3fb5370365e18294ee32a6cb85352c145184a7ffa40cb9d06bd44ddd37f51cc3de4db1479d5a9ae221d34a4a5abbebe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ac189b16f923511227423e54497472f6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8afc1062bf867e8dbf2827f5692913f0

SHA1
290729d71b6939dbc44f63a736500a5ef046ec95

SHA256
bcf1e1e5bb8c91c476c6f9f7c7ae6e260a7e3081df99c05250573847cc7a9ede

SHA512
2a447d5fcb6905f8980a6586deb9854755f57cff6a8bba7cf700aca91a165005ea2921f614c8a0c59562fc68f8770fc00cd5d0efe98eb0171efeddb5f259c088

Download Submit