cc07a6172a6bc9a2de09f517e8772e877005200d48537f170cefeede84910c6a

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9a5681b5f4ba3fd0eba2aeeef42196a_JaffaCakes118.pdf
Size

113KB
MD5

d9a5681b5f4ba3fd0eba2aeeef42196a
SHA1

8f41e4f3dc94ae91581fbad6ab5e792553f92c33
SHA256

cc07a6172a6bc9a2de09f517e8772e877005200d48537f170cefeede84910c6a
SHA512

d2d40ac459b0684abb33c2635186400f13ad5541194053ae57d39475df538ef05ef80f3210152522904d922d952dc4211b6d9dd36ea6ae3025070d2521cb4e52
SSDEEP

3072:k7k6v9qC7tbJDw4/Ic5INVNlSol55Nmd2/EP6kFs:cEGtJw4/15IN/EE5Nh/2K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2420	AcroRd32.exe
2420	AcroRd32.exe
2420	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d9a5681b5f4ba3fd0eba2aeeef42196a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d63437987ecf96c684884f047e816f7

SHA1
ff7d94a7fc0216196ba0789b5df376a6737dea4c

SHA256
99ff5f5fcbde9d05aabcf9931922c7e85890408d28c176eebb31a817fabd694e

SHA512
cd960ac96b9c5681f9642f67ec9fb5fdb75708ac297a821ee7332fc058131ce7cd0b4344f972d4bebf2b41b8c50abf000bbd033aca1d19b53154833de5435dcb

Download Submit