333b0f331bf1a75cc8d6cc801b51b972a2e0c83d55df1bcb14419e70b81f9c9a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aee8496cab008f03386df68f04cf3631_JaffaCakes118.pdf
Size

43KB
MD5

aee8496cab008f03386df68f04cf3631
SHA1

ef0cf35813cc7a262e5dc5010e6063cf1e7b5554
SHA256

333b0f331bf1a75cc8d6cc801b51b972a2e0c83d55df1bcb14419e70b81f9c9a
SHA512

d623dc2e2c3686c13590bfd4b111e5871b3efd5ba289ec223f8dd81c9b1591b69311cd9c0c584df2176779964b7f34f78e088fb8364cc1f3142bd50247b2f767
SSDEEP

768:BSm9z+QYFvWYyrm13UjI4SCuyJfkYPlwIkWYFAe4TVD5Juc2rx:BSm9zXYFvWv6UUPYJ8Ykqe4RVsLrx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1644	AcroRd32.exe
1644	AcroRd32.exe
1644	AcroRd32.exe
1644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\aee8496cab008f03386df68f04cf3631_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4d10e7b506425f5add4969aa04e3af70

SHA1
1f98fde4412846551239ac0af0d97a1d1fa93aef

SHA256
19aa0770f59890b69838dbb19887c9b6779ca28c23083e27ee842e53d5918400

SHA512
433dcbae4810911d6b4f6f1d4fb9ba3c18ab11c6fc9641abf39007de4c9cc308f662c00552a3fedb6bc954b4e246b3e4f07ca1a816b34445bfe837bcb9cd7c4d

Download Submit