58dff105e66782a70ce33d6ffb5423d3c7d58c13415889d020a5242bad4108f1

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d597e0ea1354f91891bf21b7053006bc_JaffaCakes118.pdf
Size

104KB
MD5

d597e0ea1354f91891bf21b7053006bc
SHA1

c8fe8958504892e6d519393c120f798640386764
SHA256

58dff105e66782a70ce33d6ffb5423d3c7d58c13415889d020a5242bad4108f1
SHA512

6d8bb57db225b0c4360c8c35b6ee0216a55f6ef8cf972a1b3f1f9e53d8c9bffbc70a6d6ffb6127b20153be7f3a6ac3041ec995b8262f4a142bbc68ea08607208
SSDEEP

1536:MGFmQKwAUxWsLC1F9GKSpzW+fFsBVJfmaIuc2zDFhJ6hGy6RVD//A5BgMoqml:pFmJ/H9GKSxefoaXcaFHdRFn67od

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
552	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
552	AcroRd32.exe
552	AcroRd32.exe
552	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d597e0ea1354f91891bf21b7053006bc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a898d04cb4a9bf4b878a6f503e72a13e

SHA1
15352c46b2a5474008e6eba3f89d23090b9d6f22

SHA256
ccee804fe59e81cc8e02bfff23e440c212f53a414659ded1b966622b0c66e36e

SHA512
32edf662aac89428a644ca1af401ae49b21f3121eca20c351b1f4a6148a860b4dc12046a50c4ae3fdd3e8b39d79ef2101252cd292fc5d41495b97d4ca1ad75b8

Download Submit