5057a43e6ebe3309df04b0e1ba96f9d3e772574af6193b065c358eec0b7df704

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c283efdbe97cfab927faac929093545f_JaffaCakes118.pdf
Size

77KB
MD5

c283efdbe97cfab927faac929093545f
SHA1

8a2105145e2430a47ecb607a392a2744bd3ae530
SHA256

5057a43e6ebe3309df04b0e1ba96f9d3e772574af6193b065c358eec0b7df704
SHA512

48bcfb517f1699be85c675ad0e08031e8bf856535789b6b44a92f34f9a173215827bbfe31c26cc538ac3efda05ec5bb153643fda7e6f51f3498af0c59d1647b0
SSDEEP

1536:2AmKNVWg50/xJOLjv6CHAcSe1J3ncBEaRdcGB7GTY+O6jdGh1Pm//kRX:0bg50XOLjxCyJXcBEoIE+zdGnm//S

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	AcroRd32.exe
1716	AcroRd32.exe
1716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c283efdbe97cfab927faac929093545f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e561e7e6c00257da02f5f5a927408321

SHA1
0a8ff396da0b111b2f7cdd0f55500d5a12b6660c

SHA256
ad97a85d79a5eb723e5ca1953acac729168ab67de1132543b9d147cea95d25fb

SHA512
8174ea41de81ef45b40d988d4607ebab2cfa1e0087327d508f896a3ea418034853d12fabe4c7653ed2e49d5e22de6807d3673f134533e2e67c15bbf9bd5d1687

Download Submit