5c432a9071ac101e9d6bfd90e6869d3648772ed377aca796363ff476e7cc0ddd

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 21:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd285c4ac84fbf3954ff41044a69d7d3_JaffaCakes118.pdf
Size

94KB
MD5

bd285c4ac84fbf3954ff41044a69d7d3
SHA1

aafaa2595aceb16ceaa569b7cf7aa611d1422974
SHA256

5c432a9071ac101e9d6bfd90e6869d3648772ed377aca796363ff476e7cc0ddd
SHA512

6d3de267f5e29cc0fb3a964ad9ea0861abedfce3176ec06600d9e270bd5c2c41c913dd44c33d5388c6e1f243ed62ffa820d2515e778fa6e4cd1bf32ba2f8fb2b
SSDEEP

1536:62gUpBtRaPzQxDC/5XHpiwMqgmhuZSBOsCeZqiCBRfh4tWyKqrCWHBRdI/QPWGps:dgUpDcQU+qgbZYOsRqi2RWt8qFJkGAFL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2528	AcroRd32.exe
2528	AcroRd32.exe
2528	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bd285c4ac84fbf3954ff41044a69d7d3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
16c5df1526c8bd2b2569d5b5a7042db8

SHA1
0df78ec1c98ff014647340cf2a9ccb4b726cc27e

SHA256
9b0670db428198b83a46e8d17bd0e556819eafe684cad4e2c320d26299db5553

SHA512
22edafc600a0212bc0655ad2c534f8851eb9ffdcbc512c80fcfe17ff156b5fb5fe2b87f1db8c70cc455f5c44d3540f08cca1ecb88a7983cd9010110080bb6926

Download Submit