545f3a8b2eaa521d369b5828b77c4a88a71a14fc8d3d942233003b4a91ed136f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db9ef5ebc22c37f646a64156687cc2db_JaffaCakes118.pdf
Size

7KB
MD5

db9ef5ebc22c37f646a64156687cc2db
SHA1

7efaf1816d21b2088ab4ed227f121d9cea4eb3f3
SHA256

545f3a8b2eaa521d369b5828b77c4a88a71a14fc8d3d942233003b4a91ed136f
SHA512

e4f8a784537af2dde9cea05de5617d2e2af2582532a30b383f9e7af5fa4259d895814d4c5d5b08df3b6bb5882ca57d30eba02ae2be0227368755c2208487a83d
SSDEEP

192:AUz4ULMxL1KtZys9+oOatbJjgyvGzgQIfrqnb2Ufw/vaF5qMPeNxNghYjBdxrp3S:AUz4ULMxL1KtZyw+oOUgyvGzsqbTF5XN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2100	AcroRd32.exe
2100	AcroRd32.exe
2100	AcroRd32.exe
2100	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\db9ef5ebc22c37f646a64156687cc2db_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
403460832d27f633a582d21b9b63db1c

SHA1
ae3ab30ef7ba1da5b8896b32b69acd071a7aea99

SHA256
2716cf562ab2ace3beca21188cb2fb815bf038cacb54ab4486050fe1f5611a5d

SHA512
3706902355872d0175280849dfef6e0d288288a5c8b353b030e861a85feb029fd42f4621aa27e0f43e01286409cd2ef78be4cba646bd715f01bcb3ad6d68602e

Download Submit
memory/2100-0-0x0000000003250000-0x00000000032C6000-memory.dmp

Filesize
472KB

Download