cc32e872efff97ad063ef00631864a855aba78309cbce6dc8d11d6f56bb3215a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da81defa1c521db70c8c1cb368e59efb_JaffaCakes118.pdf
Size

38KB
MD5

da81defa1c521db70c8c1cb368e59efb
SHA1

6f152e1bd758ba5bea17891a52b2b87934a8140a
SHA256

cc32e872efff97ad063ef00631864a855aba78309cbce6dc8d11d6f56bb3215a
SHA512

50951f6f47243a41d9b915bca03de07e051287f88b7896c6c0644b1256dc1c364c004fc762385c8a9be382576438beb99f8d60e44e7d77c039934e8308b4054e
SSDEEP

768:BJgGzpDBpw+a870MQDQnpS22wKRIJkV16MpW+F2hMrC4lWO1PTyBKDJKw:gGF1p8RIJkV16MLrCcPTyBKNKw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\da81defa1c521db70c8c1cb368e59efb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3a76a008fa7af4dad53abf02604da7ec

SHA1
2ce341caf4c428f2c740841e8e8e81e1b0d8fdb4

SHA256
71c76348260e3c3d00a83f7bfb1c385564dcd44c3779f3b5b6fa4040fc7013cc

SHA512
238b04ef7c5c72007ec467180f1d439c5e7b4cd4586fd0541efa50a0c26e3080840d3346b24102a47e01b9779da6ec83d3c1e16bcf0eda0b5f46c929e4a47e97

Download Submit