462f4c3b590a17f20f3c5c8e7f3ca6c303d2adb87300564233ac6b4d1242f612

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 21:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c19948e3339531bd1ad8ade6a1154865_JaffaCakes118.pdf
Size

188KB
MD5

c19948e3339531bd1ad8ade6a1154865
SHA1

01a5efb0bfde94488bc2729fb9daf95b449be76f
SHA256

462f4c3b590a17f20f3c5c8e7f3ca6c303d2adb87300564233ac6b4d1242f612
SHA512

2b1a2de41b2210fafad35c40c72de275905bfedf33037b57363974fa9c0e47855f557837beac65229c108f6f1b63edaee8377dbe9af2d2e587e23a17c276d799
SSDEEP

3072:n2irbxzGAFYDMxud7fKg3dXVmbOn5ug6Kjnii8cAFxlF+Cdu8qZLy2Sn:n2MKlWQ7Sg3d4bOBliFro8so

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2104	AcroRd32.exe
2104	AcroRd32.exe
2104	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c19948e3339531bd1ad8ade6a1154865_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dfa0e73a6dabbb13e8912fe7ac5b72a3

SHA1
efc7c5845f8c5627fa8f6fb0747529af420faf9d

SHA256
20ee2426b0f8b91a5d36c4a220958a5eea51655cb334a873b9f6e741cb9c239d

SHA512
67fe64256133c1766091ef6919f645b8026e022a402d53cce055e116e772e0106e45d9513100537267748fa92b92259b190369f78b4128413786133c4ff469e1

Download Submit