aa4f223b0610828052c9be616b488c3ad2373d002494618be9beb9c7767f469f

Analysis

max time kernel
95s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c0cda1b0865bb1ca99be1d20258eb03f_JaffaCakes118.pdf
Size

82KB
MD5

c0cda1b0865bb1ca99be1d20258eb03f
SHA1

5495348dba43a3866b5b00b72ec658e8ab93b11f
SHA256

aa4f223b0610828052c9be616b488c3ad2373d002494618be9beb9c7767f469f
SHA512

e2d492029f484bf37ed14e9df558f6bc64475101ea1a762d75c8267b1525d001f980bdbcb1493bb3a9a3a8d4b37c6cfb38727f8a21cef85bc0000ae63bbb34ae
SSDEEP

1536:DsfbU8kSjkw/jzKZohTFn8C8kbHsvEdX0O9e5EAYVEsjpFZWbpONiWGm+Udk6305:Afg7w/nKy77bHsvEdX0u4EAYCsjpFbN6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2468	AcroRd32.exe
2468	AcroRd32.exe
2468	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c0cda1b0865bb1ca99be1d20258eb03f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c40c3f9d5b7eb6c3706312d2e4cf8cd5

SHA1
e730b2658853c3da05549c9b485d0259cd61d58d

SHA256
c99301b38d2402eb2b308b942018b09c3f88e8ebe28e1b19a936fcfc35ba137a

SHA512
bf2b93b483362808826de093d875d7e017d3319ba0e5bc8d2eeabb2bf6c3d65197ff2fd92c2ffc4e803db9b21be2a566c1f3a8d332e3781c5bb451a4bde03af3

Download Submit