dcf1895a8ab1b9760fbd8ad8bc76685371658c0f5232ec8324ad1e0886e8f24d

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af4eb3e66979ee4c1147c811c4cb002c_JaffaCakes118.pdf
Size

21KB
MD5

af4eb3e66979ee4c1147c811c4cb002c
SHA1

2b2d2853519f65ad2089c089e1e25bd7a8223d26
SHA256

dcf1895a8ab1b9760fbd8ad8bc76685371658c0f5232ec8324ad1e0886e8f24d
SHA512

ac4bbc42a866cab9106c07b5ffb102d69f4d9755afdb75284af21a9251f49d3546e79a500138b6083522e30213f8f9dd3171e007380f468c980972bf57bda6be
SSDEEP

384:VzdLyx90y+Xfz1g/wDaLB4h6zUSqNmy80DDksN9dxWaAJI43lIb/Y3R0hW3k0YOX:Vzxyx90/z1Vul4YISamy80DDksN9dxmF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe
2908	AcroRd32.exe
2908	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\af4eb3e66979ee4c1147c811c4cb002c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
68eead5d97f0e8ad054c5e4f27d0e055

SHA1
f2e859541a70c4cf5544832e0c688182642c47c6

SHA256
2821f9df1e8695c84f2bb1455b579124bbbe5dea69123b8650ec2d070d0b0116

SHA512
ca1d6aca257b4aade4e30aac0b5516ece1a25a0de99bd58d670edccd0d69163887e3798262bf4824e8b1cff26da61781270fcaf5646087e1fe2233d31f102bc7

Download Submit