82e09fdcbf4141021178f7ed9390a3adb9ff6ed2fcaf528d3c1f332e0bdc2509

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d375e3e08913de220ba0eabb17b2d6fd_JaffaCakes118.pdf
Size

57KB
MD5

d375e3e08913de220ba0eabb17b2d6fd
SHA1

2e5c663a50c19580a044396e21d50fe7e6a293fd
SHA256

82e09fdcbf4141021178f7ed9390a3adb9ff6ed2fcaf528d3c1f332e0bdc2509
SHA512

a27ba35d11a59d7340b02f6affc56ade0064c44511787ec44102c4e799dd23aa8839f9f12b800d957e125a13d6a581cd81e0303fa299ecab43ac6f39caf39153
SSDEEP

1536:8wvhZ+8LPyvrfiOXaFRW92nd+mqr6mpCZZqpOrC3j/Kzp+rXbnnHTeWVPcqAoRv+:8wZHjgziI2Qcdp86mYZIpOOgk77H6eUj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe
2644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d375e3e08913de220ba0eabb17b2d6fd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3c9d7cb48e55c9e4f8a7bf8ef58d4d96

SHA1
792cd1361de9588e3dac4fd0581b75a7b46bab22

SHA256
300b6b70f8ff99cb2941d6ea66d574950fba79282c564a91b2182747cd5bd4f9

SHA512
697e4d34d61da7962c6107d3d4799019a586868bd801d31606240ef2d8f679295e78e6320bd75ef48fba1b9c791e4a1fa885cd7a8bab75842f083645784bce6f

Download Submit