83ad9cc837232ba09c706d9757ab0648204f7e9592b70e49b2e1c6c0fccff4a6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d25d221249d863017736d2403cd961f0_JaffaCakes118.pdf
Size

60KB
MD5

d25d221249d863017736d2403cd961f0
SHA1

5305548bb9f1d6db1277b6897134da00cbdaa92c
SHA256

83ad9cc837232ba09c706d9757ab0648204f7e9592b70e49b2e1c6c0fccff4a6
SHA512

3d82b65a2a366b86c0f5753b979068c30d5a43616ee9d1d956a413163bac643ffb44830cecd91548b498edb6fc610cf0487b7327ca78ff02d89a4f83a161a417
SSDEEP

1536:AGFmVyNpQxNQcFZry5yd4JwSplTW+vmglLO:NFmVyNeBF94Jw8lrvm9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d25d221249d863017736d2403cd961f0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b023a29bdba187f629936ca456a7b4e

SHA1
29ad89cd8ec2b00f542582d1b874d515fc6bc81a

SHA256
06456c7fa17b571bc5bbbed83bb0adde04ff198cd0ccbe13cb772fbf2a4a4b7d

SHA512
26cc57665d31b7a30a3eb80a84f3513eceff25df46dfd0825eef327d74bea99a92b15e84fd519296bb2dbfdd88d196782b6b757bb24ccc5c07d5a396df4a3f8f

Download Submit