f5ac4b864e88a84ad470ef66543706e7c910fea92e35177c49453a720a32ea1e

Analysis

max time kernel
96s
max time network
15s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d222ba6b06aaf30861a8fcc4d6b6d56f_JaffaCakes118.pdf
Size

43KB
MD5

d222ba6b06aaf30861a8fcc4d6b6d56f
SHA1

88487dd6312a7490b50727e1955477fe1e33e987
SHA256

f5ac4b864e88a84ad470ef66543706e7c910fea92e35177c49453a720a32ea1e
SHA512

1d2f6a9422daa0a6eb7f7c73bb52fed4aa98136a325854d2227fe30bd35bf93da8994ff8e235e12b93c6e1aabe380723bf4ac636aa305c3fbd677c2e816702be
SSDEEP

768:HXuMZmwgCLWarGE5HpuTCWF3PN+vl4bu2u9dyTik/mAKfcrZ44gFIZ9MunnWJXjj:HXFZmGWS38TvF3PN+vl4Du9dyTikeAKv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2320	AcroRd32.exe
2320	AcroRd32.exe
2320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d222ba6b06aaf30861a8fcc4d6b6d56f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bf0921b1b953910174b2e141054ab8fd

SHA1
56ca7644ef351177a794f5515ec53420140c8819

SHA256
ce33e988f8ac7535e0d9e61f0fae3b0dceb08b5ae793d5370af301c5a71c0bd8

SHA512
394fddd197e1fe5db36d17ec9dc71d0ced8497d873032c86c652b7d7be8ed9aed5ccc3fd8d82d1b57d4981221f5757c910bd116e9802169437ffd19b67ada2f3

Download Submit