982f3e41d8c29dd821f8d1c68968f621d049d3b587c51b6093746ce09169f5fa

Analysis

max time kernel
94s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ded6a85be0f4954ed78745d4c7043434_JaffaCakes118.pdf
Size

43KB
MD5

ded6a85be0f4954ed78745d4c7043434
SHA1

80b8836018dec7d861e9a223f3855bc50c63521a
SHA256

982f3e41d8c29dd821f8d1c68968f621d049d3b587c51b6093746ce09169f5fa
SHA512

715e499d3b99ee656a99964bf829bea08f8f59318cc3f0433de7c5b9e59a632626106ea8d7e36cfe2acf4335e01a1a38d2ac2a7eecd1978cc683ce2220a9a402
SSDEEP

768:BgGzpDlpm/Q97DfI9eBAh/GGGG2i3CowhAGGp3DHQqjmcO28noa7CtKYpZ3kCs:yGFZpm/3GGGG2i3CosAGGVmcO285CRpu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1824	AcroRd32.exe
1824	AcroRd32.exe
1824	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ded6a85be0f4954ed78745d4c7043434_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
06ef8db80605933d7b316714e2d1d70e

SHA1
6516ee5d4d9dce6188d70615cfda60ccf5186719

SHA256
366c194fe6ab2db6d42d0aecd66ac4d8ba7a327e560edffa0e70edc1cfcd098f

SHA512
5f3927d9f1b2b8d87b01ea38834eae1c2fb685d9fe7a04455986ba722da3597bc111510b62c60df896bfdc83b1e33f51da69b5029bc85fd64bc67571343ebed1

Download Submit