fb95d98ce49e6883f6772dba3b347ede6c15025c543ee00822c4a8d827734c7e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2eda0f9cad6c25d64106c3121fd9c96_JaffaCakes118.pdf
Size

45KB
MD5

d2eda0f9cad6c25d64106c3121fd9c96
SHA1

d8536f61acb6873d0b5c37b720cc103f953c8cd9
SHA256

fb95d98ce49e6883f6772dba3b347ede6c15025c543ee00822c4a8d827734c7e
SHA512

18cb64ae852afe6a497d0cf9ae98fdb20768e31567aa4dc50f53f3571ce73fb03e066728bb453d127dd93582c9f6eb5e53468206d0e4d3e2650064b80319105b
SSDEEP

768:83h5pHL5onopXLBFeMs0oaK8QDSC4w4j6Lkl/nZMA:83vlv75l28QDSvw4G6nWA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2320	AcroRd32.exe
2320	AcroRd32.exe
2320	AcroRd32.exe
2320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d2eda0f9cad6c25d64106c3121fd9c96_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6a93d102107fa41acb6be60cb6c82cc1

SHA1
659c7b0137eb12ac3b16140a86f846a9de4a70bf

SHA256
0fea94ca8c6f142eeb59b6c9079d59c8cd274b92103869d0eaa54eb818e68860

SHA512
b0613b4d07ff5977bfffe7169f3feb8eb8e862f6a9bc930be8e2b42952ffafcc421bd7b044664a2cde593097d30915299d2d7e952f676c0b989013fd14dd6178

Download Submit