6df5d4e33a9631c2ae00f168a4d6fc1c36419eb7a339c021736b6a94fc190c07

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df094599c335dd65e2088a62d248f089_JaffaCakes118.pdf
Size

84KB
MD5

df094599c335dd65e2088a62d248f089
SHA1

c6c30dfb83c95cb13b3ba61b6c00cd2d36fdceef
SHA256

6df5d4e33a9631c2ae00f168a4d6fc1c36419eb7a339c021736b6a94fc190c07
SHA512

ace7be3eeeca491e05cad676c21426630c842a1ac006637d16e3056cb7dd1c8b00ef025934894a62390a341326a9a6f1c764c6acdde9ef90a1e1100166d007b5
SSDEEP

1536:KwAZjc3GyOpNTkdZNNQnLmMsuV8g+l2Wi8AgzIdM6hX+hJ2Twg/LfWApO6NsC:GZoapFQQLmMsS8g+l4kcd7M2Twg/L+6n

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2824	AcroRd32.exe
2824	AcroRd32.exe
2824	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\df094599c335dd65e2088a62d248f089_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4695f5e9c458efac84e56e6bf07668ee

SHA1
ddceceb57c0f493ce3f585d853059915214388a2

SHA256
4fbbc03f6441f59fa81a7298b7ea78e00632d63b2489a450c8b51580e7cd9a37

SHA512
2255f347d05ea38a7289c4200f4ef7bc1c1bc0b01fdaf58224ae17310247a3bc1e3335c872f529e3b66f8b7a2d212484ed7de502674358fd77f287f0108de7fa

Download Submit