196fff7a614faaa8faf5e1f607acd034535c346d53dcb81b16227c42625d9e21

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9aca4f85eed3c11e947a602d614a355_JaffaCakes118.pdf
Size

86KB
MD5

d9aca4f85eed3c11e947a602d614a355
SHA1

152706e9162b4b920a64fe3c00bec6e0121b5731
SHA256

196fff7a614faaa8faf5e1f607acd034535c346d53dcb81b16227c42625d9e21
SHA512

25da74809d2e41fbada45b2cd52d696882be7674bae2cd4719c60c099c30a5e6a1a7a35b43b8154e247fca9d525bd72bc78974533aae55c3839a943f996595eb
SSDEEP

1536:RX2Q+otkYMGoiJ3Gmy6/CWvlwyFEhMoX+XZJJPU5K8cVU:RX2Q+ukYT3GuD7U+XZ3PUQVU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1848	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1848	AcroRd32.exe
1848	AcroRd32.exe
1848	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d9aca4f85eed3c11e947a602d614a355_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c9cdca345b9f0f760c0095e1009f82b7

SHA1
79293209932d2fc76d171317ef7995793bfd9fc0

SHA256
599f488805fdc9648496b199feaca2b1f29fb73674c0e6ae3bee5c6cfb30ca33

SHA512
44fdec0e275e65a7b06a8bc8fa0b614c553bba340b9ce952caa1b3bd7eb693dbc172acc80f7b8d1dbbbf542572c3ef7f59fb961a4fa0a851dd60862426dfef92

Download Submit