916ca573181ad9a8cebc759228efde86a475f29adb89144a98cc9f75c3963871

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc616d78acb9ef4745288248fe6e0654_JaffaCakes118.pdf
Size

91KB
MD5

dc616d78acb9ef4745288248fe6e0654
SHA1

59cfe81cd03311b6eb4403df55092571a9e0236d
SHA256

916ca573181ad9a8cebc759228efde86a475f29adb89144a98cc9f75c3963871
SHA512

bf8190aa206e40a0a176d1bee0684ad60c36939d7d59f0553ac28df7f00d07f9d6b5cb20800f71085d9a9ce2a7d8c7f164fc76f05edf4e6595f928606f884b2b
SSDEEP

1536:lkWYNIRXXOCJNuDk+YcIEpno6TJe06C0zgw4NuWN3Wj4SOq7i2WcpOTO01:S4uPIEpoOeVCWgxujROq7iVTr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dc616d78acb9ef4745288248fe6e0654_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
deb85d0d98d159b2c7af090bbd2561cc

SHA1
861512bf820402d3c02f71bf06a6e0f827a60dbb

SHA256
d00259782e74a1e2b379ae843beeb2901033806968b7c19108f299257f9b3269

SHA512
ed3cc6f9522751f048dc5fb97cf50f81732c49e5a27e4375a9347fea08ca882a56d44860947b5d69e844d079d7c7ae6c7bff204ba071abe615777f2e1ae2757d

Download Submit