78decd8d57188d82f84b2639904303e1eb0adf647cdde2ba4687bcb89936bba2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dda39f92af48d016c626e0880c73832b_JaffaCakes118.pdf
Size

32KB
MD5

dda39f92af48d016c626e0880c73832b
SHA1

3a35d0d81f096762bac9ec03c337e7108fefe865
SHA256

78decd8d57188d82f84b2639904303e1eb0adf647cdde2ba4687bcb89936bba2
SHA512

57716bf6553549f5b1c1d48a81f588761be517ed180d6832b330194d2fdaf9ae57305f43ccfab5050f97a763ee058e9bb8546602178e009ab411568a7fc2b2f0
SSDEEP

768:VzmzbPYOkdzwIUcUYVyNUBDVCd5CzyWiCLZY+W87BYn6mnJGfpRWwIuzg/VtFeld:vdSnAxwdYw+V

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2916	AcroRd32.exe
2916	AcroRd32.exe
2916	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dda39f92af48d016c626e0880c73832b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
00c57e1f03d4eb3041ca3164758b4312

SHA1
832ffbc408d57ebb89618575da2f2b5bcdb8d4ff

SHA256
e4a84b01abdefafafc690a7bf9e863d6a077b19e9f0893a05d24e3e21a7e74c3

SHA512
bd4a573584097ab24857ab69559dd6b01a56891fb0d71e55a7f194341ce9bf460fb283faa9a8112c3fd226d83a12b2928e0261fbf307bcca3e692ad33f6a2741

Download Submit