69fddaf6513eedb2e7e0a420c83f508b3bb48fd9fe06dfbbe566d2b47d000774

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6772b9d157bdb4d6487f91c84a00279_JaffaCakes118.pdf
Size

95KB
MD5

d6772b9d157bdb4d6487f91c84a00279
SHA1

da533b5eeea23ff66b17dcddd181cb61058cd525
SHA256

69fddaf6513eedb2e7e0a420c83f508b3bb48fd9fe06dfbbe566d2b47d000774
SHA512

fee7e29ab1e05e16a3af2bf721dc4153f63edc4388801503f48902b07e51a1d9512333db9b110f6f3f7a3bfe13591f7c186389bed432f01fe001bc1c8db9d158
SSDEEP

1536:QO2K0onrGvPRYgKXxVyUg2z4+cXMhuf0pAIggMncNjuFUorejDWBqShNtcWYpOea:igGxnSVlg2QRsABg0cNMajzShNtjea

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1140	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1140	AcroRd32.exe
1140	AcroRd32.exe
1140	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d6772b9d157bdb4d6487f91c84a00279_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f4409cafb74514e96515b0ce2dbecc46

SHA1
dc19ec7ad24816667b4312ab4d12e4b780e5fd22

SHA256
a6848f19339012d9997cc0069eb4396f597fb774bcbf91fe6cf562598c19b070

SHA512
019aafaca8ae027b21eee51369a25e322cef1926a970b388fd8220830caed497a73b6b83e7347edd595699ee31e732002a1ee697e053c8ee53440b2f07bd94a4

Download Submit