51f1d0cd3801366064949e2d6b5f5b574d0b590605b6de5799cbf5b0adbd17df

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db47c86ed32b5c2763a3e41164435421_JaffaCakes118.pdf
Size

82KB
MD5

db47c86ed32b5c2763a3e41164435421
SHA1

5f8985c261e14cb9caabf0b740cacba3d4048403
SHA256

51f1d0cd3801366064949e2d6b5f5b574d0b590605b6de5799cbf5b0adbd17df
SHA512

11a99e66c04d9d10a2aca72576cc283927bc0730b5b6e57d0de5344a553c97f52c8aa5745e4fdc27b8a3cf377e868067dfd3523d2baaadea47addfc11a243871
SSDEEP

1536:lNHD9oCv+Kv1vJlrduCu443UqLYMfvGY5iAQ2WbHvCUqNX5+WspORoivTek:DG7Kv1v70Cu49qLYBY5sK3F5RRfZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
884	AcroRd32.exe
884	AcroRd32.exe
884	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\db47c86ed32b5c2763a3e41164435421_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
89b5717405febbd215113601e8c7728c

SHA1
28be75fb35f928aaa1e44c339cd17bf104e7e58e

SHA256
0066c247e96e7e12bdcab9d3c247631d30b01f88851ba293460755791d1c3cf3

SHA512
2c520a74878a7d4e45b366aba8ee3b9096df16df9093fa18ffa609b9d0e5352c39e86d5e7c32023f124ade90eeeed1f1d38638127fe4b3397f2cfe598dd0d027

Download Submit