2513f9685628d40f0d49e5e796c0c528803441b0b417518138f29dff5fec3a23

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9b97108299ffa7f2c599d2966e5d38d_JaffaCakes118.pdf
Size

84KB
MD5

d9b97108299ffa7f2c599d2966e5d38d
SHA1

96ebef141836fdb9e56713d1e6d413767f33c8ab
SHA256

2513f9685628d40f0d49e5e796c0c528803441b0b417518138f29dff5fec3a23
SHA512

70e6ad4e66a9988e2de949451cd03bea597dd3c318c0cd39571f0c137507194a4842bdcf560ce2fa08bbc51a1c9d32597b197898a78b67a39cc6846b82408b57
SSDEEP

1536:PsglnBxt8XrLq64bNuUZfNo3n8CN5Pf+oK58DGLYWxApOGzW7AryV0iWY0v4ZBDc:0glBxtufq6wY8CN5Pf+oK+W3GMV0BNuA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1900	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1900	AcroRd32.exe
1900	AcroRd32.exe
1900	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d9b97108299ffa7f2c599d2966e5d38d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0e5b8bda075cafe38a5406a469f65720

SHA1
bd3a0d859ee8bd8f4867a1bf01c0b698f78b994d

SHA256
c65f473580388e76a7c4558f7b6fcd47d5720a78ea20fb0b35c282da07a7aa71

SHA512
34b685fc6dd318a89e3ae02b7101314e17358ac11f5d11f3c69a4e0cba55cf6b666fb532be157d340396f87043cca8b47de277a757db44d79a8184c78d5a870a

Download Submit