3b5cad1cbb8ac319f347a111e3e9b9abdb9044f75d174a0cc130f43df83e92da

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d04be2078673c4a9591cdfe3082be309_JaffaCakes118.pdf
Size

102KB
MD5

d04be2078673c4a9591cdfe3082be309
SHA1

c294f136f9e8fb1c249c3ac00b3204da9de41130
SHA256

3b5cad1cbb8ac319f347a111e3e9b9abdb9044f75d174a0cc130f43df83e92da
SHA512

1a5aca00e7a1fbd1b923d5ef9035190b42203c6eb6ea7522b057a36974967e85d408c5d3449216ccf84fe87422163f0339123ff355ca36d60cf194c5bbfaf664
SSDEEP

3072:PlohLYL8qM4IHYmCWxbtUukvSU5jk1kdQFv42TmK:PihwQV9JkSIjkSdU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2876	AcroRd32.exe
2876	AcroRd32.exe
2876	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d04be2078673c4a9591cdfe3082be309_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
659829ccc6fccd46b33d53b3b952767b

SHA1
25b1abf82328e22abd65cd25681eac607138dc32

SHA256
22807378655b0e734c889a6b350e9cd7a1d4cf1db0c6ff9630ffbeeec2591ad4

SHA512
4e0914a5631be3185713eb57aca83f9bed23edbdf37b5bc45e174e449b446ff172daaacd12a3a556bf9757a2df2a236ee9acf99ad7cc201055d97e65a0c46add

Download Submit