1a22478ec3e380cbc741df3793b2b545a4e8ef084f872642b8d371332c93a188

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c24cc03f3182b164b88472a82b796d51_JaffaCakes118.pdf
Size

44KB
MD5

c24cc03f3182b164b88472a82b796d51
SHA1

69186ea2f587ae56e67e903595c10968e9fab681
SHA256

1a22478ec3e380cbc741df3793b2b545a4e8ef084f872642b8d371332c93a188
SHA512

2e406a15bc992ac75f5cb35bb27736874bba8016fd31e54b2a287ac4e6c3df64cc4f8fce06f9586129ccf32bd7d15d4119d7f3a1995f17694d85fb2289bc5475
SSDEEP

768:8gGzpDyBVksi8pdGSBj8fRy05mVCmhqXhnswHBMj6akxRPDAYnhX6kmfvnxZ8qC:ZGFm7n5qXSwHueImKkmRZ8qC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c24cc03f3182b164b88472a82b796d51_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30e966f56d1f1369e571db8d44bd6b3a

SHA1
b70d7b24aa288976f108ba299cae33c336487855

SHA256
be4d626231ec2b35c4d0aadcc42877b1bab016fec2d0fc923e29c2c879497fd7

SHA512
d0a8b0821a4281e2aa249a16a4578a476105f2220bd5a332236bf2c64565a18bea726b504ea8a284071353468cdc3af10c3f43eb59aedb6f512dfa1571b907cb

Download Submit