b5daa1cfa9c962390ec47f3fede67055253249c918c4f16d07f243fbb5295df8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3fe0fd4c46d17fd9b9907bbfba2649c_JaffaCakes118.pdf
Size

23KB
MD5

d3fe0fd4c46d17fd9b9907bbfba2649c
SHA1

980b2d4657ddb24a79d7ec4d3138129e978a9b16
SHA256

b5daa1cfa9c962390ec47f3fede67055253249c918c4f16d07f243fbb5295df8
SHA512

84953cc0d615949b69ca7be1ac35d7251f3028639021b0bc99c83cef191577365f35869b626f7190e0a69971874d1a1ff685674911986fac251edfe65492b40d
SSDEEP

384:VzdvnU4NAxTh6z1qOOPvGN0cM8JvRL6nalPSjd/GQYhsJ8hLqEPQ4Tb/NKXGNy91:VzVnlNAxTh6z1qZuo8JvRL6nalPSjd/T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1788	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1788	AcroRd32.exe
1788	AcroRd32.exe
1788	AcroRd32.exe
1788	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d3fe0fd4c46d17fd9b9907bbfba2649c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b6b85af055e09342f83902cdf9f010f1

SHA1
c321e6c93cb39efd2ae89f9cc232d1718305eeae

SHA256
dfd14a6d0ad5cdd2550fa0c33e486ebf8794ee44e118dfbba8ef51a25e2f706d

SHA512
4d2d4dec74bc67fcb8715d3ce3b5909bc11a10495c4f4fff23c84419c4eed5dbf8cd87dd3da8f1a6f4b43018b3a9b7dd0dbdcf3510feb9352c85bb0ba3c23deb

Download Submit