cd357a16d73284d6b1dc3bb3ba6bbc9f827f797e71422669e8e1174ad67eff70

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4661b0d02d1c0a4415ab3d71a4b786d_JaffaCakes118.pdf
Size

185KB
MD5

d4661b0d02d1c0a4415ab3d71a4b786d
SHA1

8d0ff4d97367bcd06ad1659b8803b78c9f242020
SHA256

cd357a16d73284d6b1dc3bb3ba6bbc9f827f797e71422669e8e1174ad67eff70
SHA512

a418f0660365fdb82b4c7cb4e6b1e03a1202b9ad0b826ae191f368d653e6748c799f79981ff9a13491b022bd1b898db5ad7a1a8a46bd57491ecbd9f1ead4edb2
SSDEEP

3072:W2irbxzGAFYDMxud7fKg3dXVmbOn5u66KjnnQGjqBejxGHXatCSq:W2MKlWQ7Sg3d4bOXQjEG3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1520	AcroRd32.exe
1520	AcroRd32.exe
1520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d4661b0d02d1c0a4415ab3d71a4b786d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e53a4f460006fca48477be56018c0688

SHA1
f9a8932890c9c5a74a5fc3d52519f535f378a269

SHA256
2e9d6fbecc6587f1558718909ce7491f442db1ce875537084041621eba88f3ec

SHA512
702f70e1a95999cbd0a7bf39bb915dde87240750ddd605492d7b40e5079350094e29a6248609ac78969eab22192b3a4d8fc060edbd63042f49de3ddc8033d7e7

Download Submit