18248d1d969eaf8689a2227e2233a00d2f5fc7354baa4fd6d8d1107056c54987

Analysis

max time kernel
92s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4667a5571d737fb3172df1c747cfbf8_JaffaCakes118.pdf
Size

83KB
MD5

d4667a5571d737fb3172df1c747cfbf8
SHA1

0da553bd88e3ae2d32b69131ca5930255382fea5
SHA256

18248d1d969eaf8689a2227e2233a00d2f5fc7354baa4fd6d8d1107056c54987
SHA512

305caad8d4cee0bc596ad9e37149126df617de7d21ed9069c643e3b29add70db0579860c44bfd555bf5f57e23b538a4245ca728ae8dcef22f24ec67486c4841d
SSDEEP

1536:A8BROePhRIAaFnRFoqCrwYWD2XHCuOmOOZL2MWkNpOPZ+ove5wLlfWc27HXj4TM3:xBpnZqMqCrwYg+i5mOO0PrW5wLlXs3p3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	AcroRd32.exe
1688	AcroRd32.exe
1688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d4667a5571d737fb3172df1c747cfbf8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4f14d6921c1a6f0907747765890dd78a

SHA1
b1e4770f6125cdfc239f7df2002a3ad5f1569a83

SHA256
c452fc3854e3ac1f63fe2d07449f4e4cf0df49e671fc4b99829cf2c28d943d0f

SHA512
99b290dc22a3ac15424994d609822bd3df5ddaf8ee9c677e6350f447a9f0968ca60bdfb41a30311bf4041b745e880eba6c5d498de11dbd63852ddd2c876ca491

Download Submit