57587d2f3544f1979871d4cb1eb854956779ff0ff37fb3fa24ec0c157f2ca283

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c811823612d3cbebefe8c0954c0d6a86_JaffaCakes118.pdf
Size

52KB
MD5

c811823612d3cbebefe8c0954c0d6a86
SHA1

a530acfa281878a452d12526fb59b263e8a4cc09
SHA256

57587d2f3544f1979871d4cb1eb854956779ff0ff37fb3fa24ec0c157f2ca283
SHA512

41afcfdcb1753da944db1029aef6a6543ea9692cedf1a353714db1dae5c57915045d9dc6a73c489744127e0655c29fdba6751a9800f59bf434b3b166c74f51f4
SSDEEP

1536:OXFZmGWSUjWzSFSIZJf8hMtZa6iwspmpIp7RFN/IAtQMo2YGUo7mjDNszBlOr:EysUSN/rx5Z7aDN0BlI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe
2716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c811823612d3cbebefe8c0954c0d6a86_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
051bd894ad21efdc7612bcb29b0e13f1

SHA1
a1cfc7345da2a6c916fcc673d2273f4d5b1fd433

SHA256
015f5e521bc096a3479a7451ac421c6ebc5f55e5af9c404b97c986324f439feb

SHA512
2bcc51ee41f2333a62757aadc081ebaed66aec1ec81bdc74843972578900f2c5d96a26afd9b00fe85671928f764da69a42d0b081b6d62273aa14bd3777fae42a

Download Submit