d1cd6c7d7466f02b9d06ca69308d98633a4e1b1368e067a55bd9d6f0aa28a29b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ade9aff9277e9f01e488322547d102cc_JaffaCakes118.pdf
Size

81KB
MD5

ade9aff9277e9f01e488322547d102cc
SHA1

63f03cd312880cfff8a5a592ed665c1fad6febc6
SHA256

d1cd6c7d7466f02b9d06ca69308d98633a4e1b1368e067a55bd9d6f0aa28a29b
SHA512

b2fa3e25caea65a6ca3795b4b70156c784e5a6af3261fa8f89a5ce9a493b43d310cdc3ad05a6143af83f44c3da449ee53e436af10d5a050304f1e8aa9a75785c
SSDEEP

1536:vTSjpNKk6KQs7K82GiMznW7w8fFBMtn8txVvyLaRB67ONW8pO73WtVagcxm7NAL:bSjGkVQmB2Gyatn8NKWf67OM7QQxk2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2980	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2980	AcroRd32.exe
2980	AcroRd32.exe
2980	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ade9aff9277e9f01e488322547d102cc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
489c732a75a4df779aa3ea290e1cf78f

SHA1
3bf7003cfd7f3bd1087c507ad9b847ea417212cf

SHA256
58cfc4334d70e687640699862b758a6b702b4b6fe81c87e8236d6c658397c2f9

SHA512
45d3ba0c924648909f83ba0ba601f4a228b22042f4f624f74368cb8c62fd3215fd416a8806cd9ce1c5375ad4040c6b4ee40ab5416dc0e122deadc7c57d4955ff

Download Submit