644c865f5a9c4cd7b39429f9df5b9aa5975ffd53804a933b7478e21f23f759b9

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d61d52fc13939ce6e0aa332bcf7b8722_JaffaCakes118.pdf
Size

86KB
MD5

d61d52fc13939ce6e0aa332bcf7b8722
SHA1

2b73b7a81146f5b42a387b97140155beab457ed0
SHA256

644c865f5a9c4cd7b39429f9df5b9aa5975ffd53804a933b7478e21f23f759b9
SHA512

ca2d624403cdc46c3e29ae10dd3839af0e37e429e25983949d2780197176a0db8ca2ebf8c62bf3af1e7f20b498eb9aea8f0c20efcd2fbd4c1e9f150cedf43bf8
SSDEEP

1536:H2uAZ1NgnzfGA7XCkufRs3/h+Co0Z3WkNpOPaWUNcih+PgZrYz:wZsnNhSR2YGYP+f+Pga

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d61d52fc13939ce6e0aa332bcf7b8722_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9b3888296822f8adf7970688772528e2

SHA1
23bd6e65772a1a776f270771c3238de7285be026

SHA256
35eba2e4fb510e7a3d1b563d49ab8f92b46818048556e568f9aefa4fb024b5e5

SHA512
bc978d3859d3dbbfaeaa3086ce9b5700733279f2d741152ff70eb1cda38e38735207f851728dc6cada58163caae9499ee87bdab087ed59f002c91bc475ae6142

Download Submit