64530b61bf4f1a58b010bef6a574ba7898031239dc423b5686bc1a1f8bbc19a0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c86a48fbbcced869dcf15edc520097c9_JaffaCakes118.pdf
Size

44KB
MD5

c86a48fbbcced869dcf15edc520097c9
SHA1

49c6e55ab1be030d854fa68e16216cf879646673
SHA256

64530b61bf4f1a58b010bef6a574ba7898031239dc423b5686bc1a1f8bbc19a0
SHA512

554dc3d3f24b131d58f5d127184989af4af810194e23e9dcf2b5d94177a4436a6e0c095aef9ae57ff37b788cf0879c979ea51443f8c822d0ff3a3f6c7812744a
SSDEEP

768:fgGzpDyBVksi8+AzvLsFcAhHp0nxEQuI8I8wbuIjAuPV/kk9XD4R1LIbTyN7:oGFmW/inxEQCIxbuIUSVPlD4R1LIbTY7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe
2852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c86a48fbbcced869dcf15edc520097c9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5c517b19303478a9a3a5081d805ac8bc

SHA1
41c084ef3cb747fd93f20d9d9bc1b4f74d194ad6

SHA256
947294412bc4fd265a4b1d979408acec9a789c217763bdc9771a985b7f253bfd

SHA512
ff513ab8c1249fabc19868e10a842d61484c6ea835d90ca260ce9d6d0f73c607acb946b5d9a9f3e837720b23c052aa11651a52f54a3d2f9b4a9ae8fbddf05de8

Download Submit