742ecd25561f030c46dc9b75ec0c45097c3faa9ea1c1dccd5d33daadb534d527

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d63dcd0f7018c87cc9f7c32495a05e7c_JaffaCakes118.pdf
Size

72KB
MD5

d63dcd0f7018c87cc9f7c32495a05e7c
SHA1

a3a65cee173a9289781f2c4f6696ff7c285a9d9d
SHA256

742ecd25561f030c46dc9b75ec0c45097c3faa9ea1c1dccd5d33daadb534d527
SHA512

3990bc7b76f281badeaeefd6d1bc2d850ebb167b7323c61cff14af215c018f93fe2639b116bdb1253edf8974b66da94471f2db174b448030fa991d3d65d97565
SSDEEP

1536:BFmKxZKTBvLErqlKzZyJW45UXYqd94K9Qois7jrjhgpooWeqxHRXm6AHWQpOCBwP:rZKT93ljq/59Qois72yD7m6AyC2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2516	AcroRd32.exe
2516	AcroRd32.exe
2516	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d63dcd0f7018c87cc9f7c32495a05e7c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ad1652d76ad0bac4a542282590209386

SHA1
a8bd334c5fe6f4352d929ad84577c29c4c6ae1b8

SHA256
bacc4bda6418b6170a28ebfa77443062139faee3478d65434817dfb0b937be21

SHA512
c36fad002a835f83f44684153abddfa034eaf8c0ac19cf511804aa2f6f36d0746eb932e93cdb338436ba553d3698c4a985df2629bf0bd11aa8866029c6d71a1c

Download Submit