22013397e2e4d095acab15e2c124efddb61c4aa230e45af1351085279b742fed

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be46cd43816045a8af82143f001fa41d_JaffaCakes118.pdf
Size

71KB
MD5

be46cd43816045a8af82143f001fa41d
SHA1

9e81a199a92e18fda5282e8d457b50572a5a395a
SHA256

22013397e2e4d095acab15e2c124efddb61c4aa230e45af1351085279b742fed
SHA512

1374dde9fc168213659cd3f6fab16572141f2d1d206f3c91722036db9fd3523ab30e0257b210fb7fd53df0a28eac87fab76786809c6f49141838052e3073c59f
SSDEEP

1536:kE+jjv2mq3Rbzm15I3YU3SDlel5q9xYl0hyJg0HJEYDojZ7W2Fu/:h+jaP3RbzeIIugleFl0hyJjHAF7W2U

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1496	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1496	AcroRd32.exe
1496	AcroRd32.exe
1496	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\be46cd43816045a8af82143f001fa41d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
546c60db8ab4174fae6b2d4dfcaa6a44

SHA1
f5f1764bc5defad2c6ad1016ed8c6e3d2efac168

SHA256
059e619ea140873167e5c94cc997edd3c73225ad602f69d2b9976eefcc24584c

SHA512
17f9ac6e40ac73f85ccbae0ef400234551555a6ec63fea360c9f2846071227b8835d7cba15280a891bf25668cb20094ac543102905c485d148cdc23068f18ed9

Download Submit