18a280a6b4326a434b4ca4792a43738693d96489fce6d68b5a2683bcdde7edb3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcd24303293c6f7d255647f6743cff8a_JaffaCakes118.pdf
Size

44KB
MD5

dcd24303293c6f7d255647f6743cff8a
SHA1

048705d2db9166841b81a8106da5088a9f279e0a
SHA256

18a280a6b4326a434b4ca4792a43738693d96489fce6d68b5a2683bcdde7edb3
SHA512

f7740ffcb3db2d1fc714976f89e4c95fd1b946970a0e7e0ec0517abad251dc1a217be51e95febe9a123cf0f3ccd0ec6b221946aa4a2356aa613bb880ea130912
SSDEEP

768:kQQqiak+FIZGlVKix1LPnVIGkVHaU0zlvgLhhpetcZtg91I3i9vGE57XuMZmwgCN:FQqO+FIZGlVKix1LPnVIGaHQiNhpetcK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2784	AcroRd32.exe
2784	AcroRd32.exe
2784	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dcd24303293c6f7d255647f6743cff8a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d33f085d932b91ef156902a2c0bd0d62

SHA1
9d2cecdb3ebd90183b6698e7b0afbb8bef38ed4f

SHA256
7b10827758b8844b4931286e068749522f26a988effa6cc437131da06caa1e85

SHA512
4ea3a08c8cfb81d3924311c5c3aaa45f2c35d26b723d6fcc7f340059bc4b5dea8bd4c1a4d5b5e163c389062f6eeb877525946dcb9019001cdc467bc8c45bc761

Download Submit