a5086395010e0534283f78fb908498e97671134348a9364fab1752b4e0802d8c

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4e5429371a660c694ebec8baa579a8c_JaffaCakes118.pdf
Size

33KB
MD5

d4e5429371a660c694ebec8baa579a8c
SHA1

f5c601bfa88b09b67df45b2f090a5ba5b9605bd2
SHA256

a5086395010e0534283f78fb908498e97671134348a9364fab1752b4e0802d8c
SHA512

bdfd130aa98242fa25422a36409cb4a403b9ee6a4029cedebbedf32f2d1f757642e82e90425d2c369b0e38da781cc17c17e83a0dd6b1ac7fdc640d304aee25d9
SSDEEP

384:2/9CC0OviZT1bAf1ITMr56P7Ptpt/IR8UAt55lwyt9dpOIn04qOlCUS3RNek/gJs:Dh1UfqOy7Pnt/SV7KX1qayNT/A+Q2P

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1820	AcroRd32.exe
1820	AcroRd32.exe
1820	AcroRd32.exe
1820	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d4e5429371a660c694ebec8baa579a8c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d104852015f21faf42e6b362570ab110

SHA1
ab894bfed7ca0c2cddb494ce82d224d191d8c143

SHA256
0054616e3641b137a946c1763dbf819288dcc2b39183ed4a3ad143d85f921ded

SHA512
5908a8f99153e150b8ae33227cb975ac21c38ffbd9b322a42cefac2e1a25cfab52276c3a87b2df1350d869c5dbaad73af6020e8508de924fb67a7210129f3ed2

Download Submit