1928588e7be0b0400a67f18b33723812b188e497744b2f29ac30778c160146da

Analysis

max time kernel
104s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db88ed707ff5c81594a70a6f0ad8bb12_JaffaCakes118.pdf
Size

100KB
MD5

db88ed707ff5c81594a70a6f0ad8bb12
SHA1

8c9686d8b1cec7cb4608f1c02d3b585c3fbe3317
SHA256

1928588e7be0b0400a67f18b33723812b188e497744b2f29ac30778c160146da
SHA512

20dcddee1749af258760b1c621f1cdd2408c7cfa184ace0d70a226897bb708423d03695566e1807b75cb443f673a217f4addd130edbf80e64f16c3194f027dc8
SSDEEP

1536:U1tQccKxe/S8YKm6fUOsykMaE3CSWqbz9ZnpIiNjw60VyV1W1eirSWhDGWepOizQ:KrEO+kMaE3CSWeTnaKwrVSaPS4D3iBNg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1640	AcroRd32.exe
1640	AcroRd32.exe
1640	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\db88ed707ff5c81594a70a6f0ad8bb12_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
010ac1439977238dd4e7474dfcb05f58

SHA1
db3eb623f57cf9217c1168a83e279229a13788f5

SHA256
8a6a2b7a948771ffeeaf7c28fd8aadb394944be7e70edf0cf226fd10950c2008

SHA512
aa37a349e567b53632a7a836abf14474e3adc19eac27d8bff47cef48b23d5b4cfee5c734385c4529c0ae475a24db99e023c222cdf44ef616190847bd3c3763ad

Download Submit