692bc28ff2fac5ee57d4a4c0bd236ba839bc3253535f65f83b68470a1f183f59

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1d4ac9c83befcc601ec7d2a00e727e6_JaffaCakes118.pdf
Size

52KB
MD5

c1d4ac9c83befcc601ec7d2a00e727e6
SHA1

25c4e13e7b5e7cd576eced961680e2bc351ddab4
SHA256

692bc28ff2fac5ee57d4a4c0bd236ba839bc3253535f65f83b68470a1f183f59
SHA512

b9a6ead2f179dd8d23df9d72686ace75eab2ff6efe172aeb929f3222621cce66f44316a6ae8520530342228333aa5add6799007d4be26bf8c8913a95e703d51d
SSDEEP

1536:VGF2KoHs9E17JnGvM5Vq9Z4AFIAfOSTzqRQnG:oF21qE6M8tSRR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1712	AcroRd32.exe
1712	AcroRd32.exe
1712	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c1d4ac9c83befcc601ec7d2a00e727e6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d4d514f17b1fe8ffd0326d36cd097ce7

SHA1
4ca3b1d46b32813bf1efb090a7f195f00704b205

SHA256
fae55fe1c59f6cb0431421817dc9beb0b733f5b0ce9950cbbfb99bbd0ed75989

SHA512
5a2e3eb6b2837ef3250bc2ca12c81d65bbc50d9c6503387231c5dd1f0f7ab474e5c02a63708ecee708b2056cf5ff065bb6a9a2ba679c04d647201e58dd41c0cb

Download Submit