513f67640a80fbaeeab5215b1396fa81247a8338266c75d6f96c4f67fbea5a88

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d99df7be17a1fdc0c08294bee1947acd_JaffaCakes118.pdf
Size

83KB
MD5

d99df7be17a1fdc0c08294bee1947acd
SHA1

7d610b9227b7f241efe9b928cd057bdc23b6b867
SHA256

513f67640a80fbaeeab5215b1396fa81247a8338266c75d6f96c4f67fbea5a88
SHA512

b21745f7874198a4c71a11195554313f5d5407b18ab1da95c9ea8e901ed0974fc0a73453f421abd1ffda28e3ccc06302c921407eb1adf465436dac4e78b3ad16
SSDEEP

1536:BmT9EnVVfIdrkgljsZtvXnWXLdZHId8yIGXko0F4zG9VgqCP4jFdDHFiv3UqqRAS:tXI1kCwtv3WXZKd8OtL5qC4BdjAfXaAS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d99df7be17a1fdc0c08294bee1947acd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0f7363b47c4db92819a2fb8c5464684f

SHA1
48a1cb479f70602aa903de9da7f9f63303125165

SHA256
f9fed44d3d091d0d96a8e74ceffdb886633846066812a99eb44111d5f79bd13f

SHA512
4ebacf2d06746587cb674e07b03d69c87aeed1e65bafa64ac9142ece19077b739c8e6d5e298ba645c4aa316c46f3a2b4abcb11e1fe03e3bcdde53ae64ba47270

Download Submit