425803d2bf940862560e0b45c67db671975783a9c3a4c99b2a97387fd3d93033

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfe015462a3ab0663110b63885906ac4_JaffaCakes118.pdf
Size

91KB
MD5

cfe015462a3ab0663110b63885906ac4
SHA1

89410d45b36ca2c983fe6876de9e190ab6681aab
SHA256

425803d2bf940862560e0b45c67db671975783a9c3a4c99b2a97387fd3d93033
SHA512

a6524c41bc776305670e4632d39924c2202ef33d0f2f52fe90ae754e57bd1429812d59e7d6d5282fcad15e300efa1f7badd14ae1ef45b0c4a1df15c10da556a0
SSDEEP

1536:jnaB7EGks3tXZw/chHzPsfWB2rzKJVc51MSTtWkkC3Y/6V8WGpOmjoGCo3gNzgQ:u9EGksqchHzsfWBICx8RnVhmkoQNb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2408	AcroRd32.exe
2408	AcroRd32.exe
2408	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cfe015462a3ab0663110b63885906ac4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d62bab14c3f7467be304a4ab1f8c3446

SHA1
bb4df1cbe38014888780c70fb42236654012250e

SHA256
11e2c17a1108f178179fe169a9581076a9748acf258e68d3136eecb01064defe

SHA512
18b4a7c5f206c87f2bfbd367a081b38f35118b28a8e6199d21e5d39df941d30d1dd5e52d76811645e475a3329f9065e0b5a0e13b5a42bd2836cd56af4aac2a31

Download Submit