4dca6901ced08f5aed7b0e5a1e6ea64b9d3c937fa2194520f5f08797ee377ef6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8dafcd4c99b42aee31ebc988d7580ff_JaffaCakes118.pdf
Size

72KB
MD5

c8dafcd4c99b42aee31ebc988d7580ff
SHA1

d622c1fabb2fa91e29e015d8df5e953ad073f9d1
SHA256

4dca6901ced08f5aed7b0e5a1e6ea64b9d3c937fa2194520f5f08797ee377ef6
SHA512

e0991cbfbdf7b6dedde26d3dd4796eb54137915d81387c02ffacdbfc49521f4817d84f5ff1043a6e48b56a6f197e2b60cf966cb5597c50d8098722979a0a989a
SSDEEP

1536:G2aVoB6emZA0rROAsCi+IoSy3m28IGn7dpMeIEiJTkcYrF9T4:paKNmfOZjoF2423MeIXJTkBFm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	AcroRd32.exe
1688	AcroRd32.exe
1688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c8dafcd4c99b42aee31ebc988d7580ff_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
643dcf789ddc9b475de10dcdab9eca8b

SHA1
517376e88e35caae3cc43ea98e79e67b0b89fbd1

SHA256
be7c46f3d1a78201cb4cf165df0225c6eac756be4b04ff316ade92507135eb00

SHA512
24f83b669312fb68213b6d406879245be8198664792df594ae8e1f2f70a6cf94958119f361cb978a6e9ba37a1fcfe04f2df18599f278ed7d0e49b0835ec5d1c4

Download Submit