2b7aa02ee45addb5c0144faa34fb2c85ba627dbc38ae021b522c95fbdf5d2f1e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3c43fac95f284a77c77e1f2b7c0da5f_JaffaCakes118.pdf
Size

15KB
MD5

d3c43fac95f284a77c77e1f2b7c0da5f
SHA1

919d209a1d4ab7e30127916ab26d2d302312520f
SHA256

2b7aa02ee45addb5c0144faa34fb2c85ba627dbc38ae021b522c95fbdf5d2f1e
SHA512

f9bc83ff95f9978232bf1b57ef69dcfe22594674a801d6e50c66d4204fa26215d19ab1f2a8e381c97de2cd2c583dbcfc2a0ba48db1a301126c63c42d83fa22cf
SSDEEP

384:VzM8sjFpHcwz1ZXiyeii477Tc38U9ggsBbHnn+K+sUCWbVk2db/sHGITT+TxrIes:VzDKAwz1ZXiye9+7g339hUbH1+NC6VN+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3036	AcroRd32.exe
3036	AcroRd32.exe
3036	AcroRd32.exe
3036	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d3c43fac95f284a77c77e1f2b7c0da5f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6426e6eb7f1bb3e90d78b89f47904690

SHA1
4245dde0e5f169640c4740a88b8bd95c6ca73d60

SHA256
b0fa52df1dc493af6bdabb5beae1aef7dd2b3e5b53dbe5a13c0a02cce553fc89

SHA512
20afd40060865e2a036fb4662673b731258571296ea0a103a13140d6efbaca2b5f8e36a2b6822ca86817505c7286856311c5c3105238ff2de6696c9429012e75

Download Submit