2f5d2d1f699ddbe1500a4a224056564b7532ad7dff88d2090a7e3d2c04075e52

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcab23f94397bad092b4832dded7c13a_JaffaCakes118.pdf
Size

63KB
MD5

dcab23f94397bad092b4832dded7c13a
SHA1

df356a07bfb801ce35ed49ffc6981836e474cd96
SHA256

2f5d2d1f699ddbe1500a4a224056564b7532ad7dff88d2090a7e3d2c04075e52
SHA512

76f8148f1b568bef97b5f9283730c353bab12bda20252c47bb4ae488479472e7d2151cc45508f145a5c18b652f95ef768e6f52dbab397c0cc6558d760a0727d9
SSDEEP

1536:Zgvc3BxatiwVxIxkUbGNEhbl5S8Qa9KFKG11itSs2V8kXt:dRkowVxMbGyRl5SBacFuSs26kd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2672	AcroRd32.exe
2672	AcroRd32.exe
2672	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dcab23f94397bad092b4832dded7c13a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6146d2e2dac6b34a2d0f6a5e6aa445a7

SHA1
d8328f8a14eabfed178783a96eacaab92b684921

SHA256
61140ff934684d1b9eb9f32abbaddf004262c270567bddcdf2a85f2352e1f327

SHA512
4186d9c3f756b8dd17817c6cb372152cff64fac682878e3d21ac03ca88d3342797a2ef32f4f8bbae2997816d559d83ae2a5afa6a541f566891ae8c29ab92c01e

Download Submit