33a67955757cef15b3b81ff426c17496d33cf72cd70dd04c9d63af83a5470b09

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c28423c6ecbd4643cae9e50411e5fdbe_JaffaCakes118.pdf
Size

32KB
MD5

c28423c6ecbd4643cae9e50411e5fdbe
SHA1

1e708a9eb8b6832f35aa6c0f7140fe0793f3a76f
SHA256

33a67955757cef15b3b81ff426c17496d33cf72cd70dd04c9d63af83a5470b09
SHA512

6624d0cfb315aac03f8246b02bd7e129693c6d0bd397782150e9f5a794b039fcf96d54fa5fff9e42ce5b6dd55aeaa61306e2645646ebd7ebef83bf9f77eb703b
SSDEEP

768:zED5rLaQYpGiCPRqm9chymmjJ9EGVrOrPTB/8lX7jlHIdh99LKE5lXuMZmwgCLWx:UYpGiC5qm9ch5WJ9EGVrWPTB/8lX7jlV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c28423c6ecbd4643cae9e50411e5fdbe_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aa73fa5bece8dd8b0a54c9fbd9a2e9eb

SHA1
cd3ffefb88e2e538d3dcd42c52a862f0345ac00c

SHA256
44f3ec0424d1c49e11a6912eaeb8608a8f28963e253d384ca46075da8c6a98a0

SHA512
34497fb8bd7f05aff0e3ccf5e11dd133ce435b65497896278be98f9ccc33b8e7b59ab82e09b9e9e6c3a511e624919e304e910601cb4dd274b3d0400dc4534595

Download Submit