f52ffb565f0e2e3e6fa948fb434b55e81c6501859796d952938507b97594d371

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad46a526bcf63af9f765ac7890fd8314_JaffaCakes118.pdf
Size

16KB
MD5

ad46a526bcf63af9f765ac7890fd8314
SHA1

7c5b73cdafa6152d5153948c3629bcb9c77321aa
SHA256

f52ffb565f0e2e3e6fa948fb434b55e81c6501859796d952938507b97594d371
SHA512

1602b14aece56c2f44b1b307848042d288235d75773489edb6e6cc8d960aa3a11d40ee460e7930aa43a9086e958ebd96b8198203e827390a8443f4c7cd9955c7
SSDEEP

384:kPV1u+1u2SBfkvzaNwdwhr+GCgB5yUZiyggBOZjPRHDo0rWjYf3GGYn:euTmvza6dwh/C5Nyg3ZPRsCyV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2172	AcroRd32.exe
2172	AcroRd32.exe
2172	AcroRd32.exe
2172	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ad46a526bcf63af9f765ac7890fd8314_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5e09b192d5ccde9c5c2a128d08bde95a

SHA1
5341b832c307592066083d9f3ce86c73ea7d8fd1

SHA256
e943dd7b5e6910aec2990726752147b816afa05cfed3cc7efe07f55ed7428c9f

SHA512
d6db54f60781c60db04a5ceb0bdad0d6c5a67c50c80b55cc5bac5a5c6873e4bc24df3fd4a6dfe3dbc4feecaa265e8d0e77d946c718424581a5ab451366668ac7

Download Submit