82a829dfbf9c6d3ceeea8181542a13e2536ec66195a9c90651129e538f1fa95a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c15a400b286661ba1dd6372aa3cf5c05_JaffaCakes118.pdf
Size

66KB
MD5

c15a400b286661ba1dd6372aa3cf5c05
SHA1

50eab16a57e37566b81fd2de62a905ee07491df5
SHA256

82a829dfbf9c6d3ceeea8181542a13e2536ec66195a9c90651129e538f1fa95a
SHA512

b37a1fa8ca549eaa16fdd596ac2da62e705767af8df9f454954f64e0cdc10a6858b0a8b344cb2a1e8bacbe75a9bd35efd13cb6930dbba6a1bc6b92deb6f1ce27
SSDEEP

768:rLZS+zp+OQJ/NT66M+MkTkHAgFFIMM6thHyT7OBdbRPuFhfQi4BdN9NfDMi:rLZHoZJ/vXrTkggF2Q5u7MbR2lowi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe
2416	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c15a400b286661ba1dd6372aa3cf5c05_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
18c03525edfc93d9b51e9e0f400f96fc

SHA1
480217b2bb1327903a8364958135b823fbe8f174

SHA256
8ac0996c0cd6fbc302413826d5183024eab011c425fc50d01259c535e32080d7

SHA512
157e25e5db399c29a7473554aa3152a8522cb165208cce32d8e58f48c2734e64e7b2e134c77f907b997f7befabb6fd1429764c1efc51b8ef71d9fc348ef2a549

Download Submit