d051a27c082a30bb58a4fb6de2f452e7a9215b5509e28cc488bb089e986c92cb

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aecee9e119f563745d88ffa284f6b26c_JaffaCakes118.pdf
Size

72KB
MD5

aecee9e119f563745d88ffa284f6b26c
SHA1

1170a9e4d92d7ff19f07451a7918c2b22ec78c7f
SHA256

d051a27c082a30bb58a4fb6de2f452e7a9215b5509e28cc488bb089e986c92cb
SHA512

cddfd5092e5a245c2cba1c8207913e35fcdb2de48e9cbdf107bde912f3785fab9032e25b9fb47a79609a25154a305438c34cbc5be1ba7d5aa47d57b7ef3c752b
SSDEEP

1536:dUgxUNNtHdvSRCg7B5oK2ctRcZeesFfdCq/WZRFr70RZWspO2SBy/:2SIfHdqUgFeKINsNzIFX0R42x

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2688	AcroRd32.exe
2688	AcroRd32.exe
2688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\aecee9e119f563745d88ffa284f6b26c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa4d23fd66edcdf8fcf0f892463f30fa

SHA1
73aee5ada4d8f9c43d4963366f75abdc1867e780

SHA256
4541d8f95c96949042bfc231edb0134b1e3adf25d9572bbfb6771d875430d524

SHA512
d8ac4842c40f606d06e820aa914051a96e202cf85312ffef96465270fa3f24ad7fe44ed6482035fe789489891370d6703c52942e4c1da650f3bf94298574e71a

Download Submit