9557beebe478ce6f459dd21d40bf9393ddf3d031ffe2701a2c0b92dfcf8a9066

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dabb3f755b179d8f34d3d8af886e50d8_JaffaCakes118.pdf
Size

84KB
MD5

dabb3f755b179d8f34d3d8af886e50d8
SHA1

2a295ac0fc67b57115c706e4ba14dfdeedf04e84
SHA256

9557beebe478ce6f459dd21d40bf9393ddf3d031ffe2701a2c0b92dfcf8a9066
SHA512

4701539c125aab98568429d2898d77c685a7f888d58e9148573d118cf5de6e4f1a2adf9cdcc24bed423eb2c07defa4db6d633cbb4c5e2d803e050edbdf589979
SSDEEP

1536:iYZC41j4H0vYVNegtZLufEZBdUl1c0W6pOu2w3S3H0W/YSp7L/7NPqF4eokqF4eq:2AortZgEL+1ctu2w3SXrYS7vNpMoU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dabb3f755b179d8f34d3d8af886e50d8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
121a4e2db0a9b537f6818655dcddc4d4

SHA1
e2a0c3676e0c55e58eed13b9a3842da36a44dfb3

SHA256
57109bf7f360b63d237b018eeacbbf25abd2666bf6b24aaa92d9f71d1e375db2

SHA512
4141bdf9ba4de206db9dd9e4cbd7bc8d07ac139cbbc812bce7db6207c51a5cde6200bbc87f80a4e1f6585b7584c86ce37c3bd10275ef17bcd56b7fa789c73701

Download Submit