44246842e82147a9bc75f9de51992d200f220d63210d523dd5dbee50fc36ee52

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d248dd66136103254148b7b30b100781_JaffaCakes118.pdf
Size

86KB
MD5

d248dd66136103254148b7b30b100781
SHA1

f4b873a263d06a2e9bb3d8271d4aa9d849f94d8e
SHA256

44246842e82147a9bc75f9de51992d200f220d63210d523dd5dbee50fc36ee52
SHA512

56ca34fe22592233e3a2ee2b92aab54ea9f02cf242b7ff38a5964d0d867a40eef8b6d12c7dcf3ba1d4c15c09e96c4cec4045ffdcbe8caf2e558764b0846b0fad
SSDEEP

1536:6qsdG1Ih9EVknUtFN7t6KixqPJsg0FrUhfMyBufcPIWVRPyOWcpOmDeH:7s6Ih9EuAQGPJzEefMGTPryhm+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2896	AcroRd32.exe
2896	AcroRd32.exe
2896	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d248dd66136103254148b7b30b100781_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
af44bd377efc23648744a6fc8964d541

SHA1
1dcf3bd06c75af207cda368ffb6192b1d3719eba

SHA256
95026f5760e54a9f3b2f3a525d808c8075367859303474f748a9444ffbfca303

SHA512
850b16f9aac87045939103063627674ac801b810df8c17c7125780329585ca0f4aff5e42e155f1ecb10477a07d83d63711d3c315b93425d59b0946664254c01d

Download Submit