4a9d1bacc54c0b85798854bb95845e1ebfd6e6e20719146d0ba5cbb94ec30cf1

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da7d48a1805acf46e19b2b892907ea0c_JaffaCakes118.pdf
Size

39KB
MD5

da7d48a1805acf46e19b2b892907ea0c
SHA1

ef40e45a13400542631f4d2634d82f6ffd978f43
SHA256

4a9d1bacc54c0b85798854bb95845e1ebfd6e6e20719146d0ba5cbb94ec30cf1
SHA512

ce06b40de5f13ee5a00dcc4f132334c8a744528aede6234ad6359cd77d72ed08068fee9e78718e3edadf02ae425c62c08b8b76de3b2ae5378f45d00089098cf7
SSDEEP

768:AXuMZmwgCLWarEE5Hpx79K5rUviEvOWk0guBdNFxWTL7EorWxxq1weQLZLuJgdwm:AXFZmGWS9j79K5rUviEvOWk0guBdNFxj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
840	AcroRd32.exe
840	AcroRd32.exe
840	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\da7d48a1805acf46e19b2b892907ea0c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
554305abeb756be6103aee6b0da58561

SHA1
e1dae0772e9475f440166a788b6ea4c4ec995296

SHA256
8ab6cb2f4061d6fd679cdb68746320b33a7da87450cb8da32adc08dfb999aed8

SHA512
ddc5c4aeba2099bf90d01765d5cf8bf868e669b28448a18dc417286b9e49d2d5aadc899cf5027e96d67c40b90b86682a22b9b6c8c84920c16faf0297ac140f2c

Download Submit