91783138f8e7f7a08f00b360f67b65afc0c6969d4bfb475ab1be7190ff954f4b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c12a94e8949736dd1162f24a21a4a9e4_JaffaCakes118.pdf
Size

80KB
MD5

c12a94e8949736dd1162f24a21a4a9e4
SHA1

044071286de10e7c2b4322909da9750bb9e430c3
SHA256

91783138f8e7f7a08f00b360f67b65afc0c6969d4bfb475ab1be7190ff954f4b
SHA512

03012a770cd837d15804c24dc1f0e404bafe966342337208daf2e63828c10547cba5dc2b66d679462cbaecae6d234f15210730436ed5a0141b9e67ba3cc35f41
SSDEEP

1536:SqQY4GzVQOisl6r/65eZuRdnE36fQRdW8pO73WPbuzmGQXiN:PhG65eydiXRc7iXk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2472	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2472	AcroRd32.exe
2472	AcroRd32.exe
2472	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c12a94e8949736dd1162f24a21a4a9e4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c8572065df44e008be03bc86fa13ee27

SHA1
72185b08ba29ec54dfbcb68b1eab742603f651c1

SHA256
1e1ccbcb74c16a6b77b600487d0e3997d6bb18cdcb20cf2a240e78a3abdfe5ec

SHA512
39cc7a45f5d38d419fc8e2944f3046021bf1a9e724a70e91184fb6bbdfcf376341df32a32c488b6aa8fb28001ed151eaaf8d7e57627f312451fb8f10d7e687bc

Download Submit