f6d8a4bf3cd1e465fc3eef4c14a5490990e7f533b5d21989c3896085d6913f3e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf35e4579d38c34947fecf1e0c190129_JaffaCakes118.pdf
Size

81KB
MD5

cf35e4579d38c34947fecf1e0c190129
SHA1

46896217bd77a54faae0e407744eb551641bfb67
SHA256

f6d8a4bf3cd1e465fc3eef4c14a5490990e7f533b5d21989c3896085d6913f3e
SHA512

82b8d06d2db5e0d7755d233f0e7f3cc560d57888f5f5ba0d09667d9565a11301668312045cf89da0c196cec02b177fd02d4359d166c9e8fc4e2e71559589534f
SSDEEP

1536:w1FPiyenyCMwSmj0/2X7HbIANnRZJ7kbAFu5HKWGTsqT5qWapOtQ4NSRdh:E2fSmj0yPI8Rf7cAFu5QJXtQ4I

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2120	AcroRd32.exe
2120	AcroRd32.exe
2120	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cf35e4579d38c34947fecf1e0c190129_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
534f271dd4c0b6ef8f62f50f8162b118

SHA1
092e98a2926bb3e1155292ce6e7b2e01207e12a6

SHA256
7278b8dce3c452a18ee084628240c2022861d61d65ae2c4ee2a5de2d538ea462

SHA512
810eb1835fbbf68efb753faeca5c7d0c0b91232125b99bffbc1d55a968ba987b6161134822c9f859fe19b1469bc132f9a982a4f1b995022c79feaddde4f79285

Download Submit