44c4e2ee4ebe55ff404bfffe40d5996c41b93564fb6905bc4989ca62237c88c1

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d653e4f5a46d8d868db6983a8df9b897_JaffaCakes118.pdf
Size

49KB
MD5

d653e4f5a46d8d868db6983a8df9b897
SHA1

4ed48b1cbe9dc3d1e9029c1fbc0da8bb8db1f9ce
SHA256

44c4e2ee4ebe55ff404bfffe40d5996c41b93564fb6905bc4989ca62237c88c1
SHA512

b9c3e4e88f9e78e402134f5306a7b931d9c05c1f7c02d8c88759ec1886b81b9c8efc1595b66343725e6316360aa48c466dbf3cac0d62eedeb33b92e3d5ac588c
SSDEEP

1536:8XFZmGWSHjTuOeiPkgYX030ibGTKlgCZ1KhgIPizv6WLwH:qysHn30SGTKl5NzyWW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d653e4f5a46d8d868db6983a8df9b897_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e073c30c828387dd5957e3556515a0a5

SHA1
c4136c86a62aa386ce0beb6c652c41ff4672ed92

SHA256
3681e6815ee3a387339e4b26fce5aa5d77499ac2f0955695e08a3fe65d1a3e84

SHA512
8f39f9cbd1566d27b59748b71e21405f12953e646680db043f40fb3b3ea789d9af31aa97a8011d52fcca071b6957c0677bad099f9d9c4ceeacc8c911e73e8334

Download Submit