26a40ee95fffb1cf696fb06a11fe12af2ca5c080e2cff362cf4695bb3524148d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da4caf8fcf8d3dcbaa5a813373a78675_JaffaCakes118.pdf
Size

40KB
MD5

da4caf8fcf8d3dcbaa5a813373a78675
SHA1

4fe6ca485f7a4dd16bab50f59d6aae5947473f6e
SHA256

26a40ee95fffb1cf696fb06a11fe12af2ca5c080e2cff362cf4695bb3524148d
SHA512

2fbc1b13a26bf467909c29cba9e8769936852c880def26bcf9a0dd89771a9a312761d9fa6c93601924258cec7e2bb303613fcac514c17a579cf262f7441636a7
SSDEEP

768:KgGzpDIpr0l2sURQ2+SrGx+AF5RX2hvZT0h8Ild474eRG4KzK6g00aULMO9z3vr:XGFsp/Q2frGUu5RJld479QZzbgLaUTBr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2196	AcroRd32.exe
2196	AcroRd32.exe
2196	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\da4caf8fcf8d3dcbaa5a813373a78675_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
39e5ef80a35ebab4952d155254f06d95

SHA1
9ea3f2f91cce59c6a95df94d2adf9bb2630566bd

SHA256
ade303c8b31717f4f51bf9e19c04a9111bb098ff3f7a7e74ce2a0a63d0c17641

SHA512
b4b0b0fca88d7489cdffc1c2a9b710bb8735aa364dc3bbae11cbc25de6166a6accb008ba4c26fb885711e25d513b8bca0f295c4af0b81746ff9993ab6513580d

Download Submit