693813e5ba207321768140e0ba0eea08cd7e211c77a3d78db7bb6817b36e9627

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc2d93e8669941ff1726a2e0a3728080_JaffaCakes118.pdf
Size

45KB
MD5

dc2d93e8669941ff1726a2e0a3728080
SHA1

fbe62ed3500b810bcf34b8ed21e6e63340fd4cd7
SHA256

693813e5ba207321768140e0ba0eea08cd7e211c77a3d78db7bb6817b36e9627
SHA512

ee2a06965ba0c989fe045d6576d1f0dc8a42b6de0866a63ed8d2082734cd748d7aac9c73e61cbcf017bd8c3eaaef62527b447bee00b1bfdbfe0546074ca027e3
SSDEEP

768:wGZOkgFWXiVz5yT9w0YbeWaP6Y7nYnADAwLPDr9dW5IXZAubBevE:wScKtQedYELDr9dW5UZ1wvE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
816	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
816	AcroRd32.exe
816	AcroRd32.exe
816	AcroRd32.exe
816	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dc2d93e8669941ff1726a2e0a3728080_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
496b8a1763c206133e9422b707c4a620

SHA1
382b0c95cc90321c9482d34548458026eb413f82

SHA256
7ad081d820e867a8d49450bacbe0442e266a2ab66b1e453902f059882e70fe27

SHA512
e288a69a20ecaed0bc452c96f8169225dc7193b12e0e2db8fa7e4c96f116869616ad213a9baced7cef8798edcb40bcb341a4531e5eec3fdc4c383327d554e826

Download Submit