49d3ea4d095d3d8b17e310684100e46bc18f9dd94d3cff71b3716380fc08979e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bed4965e602b255debf6028b4843dedd_JaffaCakes118.pdf
Size

45KB
MD5

bed4965e602b255debf6028b4843dedd
SHA1

9b276afdeff2668981ee6f679e27773401361a42
SHA256

49d3ea4d095d3d8b17e310684100e46bc18f9dd94d3cff71b3716380fc08979e
SHA512

81c1c748fc4cdfb6c2be851156d1f18f3f5cb413de05f4b3c6115d59972677add672c2d60b8fbbe5d5a302fe7d1c6096f463ec6bcc2b4896b8d6c8ec590eb940
SSDEEP

768:HgGzpD6ppSHbYj4enPlWfIW9vK7/1I+kG7NTeabAgJCwkfDyPe4sI2CsV1sL8EYB:AGFOpLT/1IPG79eV8C8PJ12Ccry/I4xI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1500	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1500	AcroRd32.exe
1500	AcroRd32.exe
1500	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bed4965e602b255debf6028b4843dedd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
472d2673e4e53a93bd0dd08cb2f9ee34

SHA1
a5f5230a719c8cbc8bd0fe8ca5b093b01d71e5ae

SHA256
68e40b17afa33a44ecc8371579e644373170f9211aad41d5e93273144bbcd326

SHA512
a39abb8ebce258cf7ad3ef3588110fce3a319a067b98052ceb04f0649c0c84be2f0c7537d9b5c03fe6d36ddbc2ab2b3b9e98968861f2266fea99dc0a947d8ff1

Download Submit