96b85c8bb318b38fb0d9e924fd6bc11ce4b299bc4034e451ca35a577513c917f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdf9c00aa04533dd8e47d0b20dfe2368_JaffaCakes118.pdf
Size

47KB
MD5

cdf9c00aa04533dd8e47d0b20dfe2368
SHA1

2ccc96c60813b985e10e0d5eca8d8dcbdc94e274
SHA256

96b85c8bb318b38fb0d9e924fd6bc11ce4b299bc4034e451ca35a577513c917f
SHA512

8dd3ac399b9cf580afd80bb12466e2f424060072fd09328efbd3ec1fc6b73648f4fcd140baf52a7cb2d716cda518b1d67b6a008f16a3db35ea97cecdc8570c13
SSDEEP

768:ZgGzpDspeCzWg8YcNgGE4sCv30oo7AWc05pdSVsVleGSpJEgPJbZJC1ZTHhvA7gP:aGFIpeoz7AWP5rZPdW3PJbW1ZTp8gjw8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe
2392	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cdf9c00aa04533dd8e47d0b20dfe2368_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d554385305ecefc681254c7d9c3ed2e7

SHA1
a9e48e2e31c701fc6568a49c1b100bba5b36269d

SHA256
263f1f02093040e232db02c1ff0b1b7122b2858ff6c78b3a646a914e05585141

SHA512
24c72ed2e96eac807b176d9a39d330745680583003090f1b5e318b7abf5863182e503f724035fdf13f6519f7cde3aaffbc534277d5e38630f7978738401680e1

Download Submit