4b500d092b02860c10aa7e5e32e2293d691f6e6e066116bc3f17a31f68a57d73

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead2660022c80fa664aa704ac2e30f54_JaffaCakes118.pdf
Size

83KB
MD5

ead2660022c80fa664aa704ac2e30f54
SHA1

f3d05ed25baba9327c7afca739127bb3e73c9e3b
SHA256

4b500d092b02860c10aa7e5e32e2293d691f6e6e066116bc3f17a31f68a57d73
SHA512

303eadf3c0bfe031aeb2c190dcc0108862289b15d5b2bfc6eb0aa820773994bedda93be641c1561e35e3f665f32735685ec6dbc6e7a810d3e5ad4e52d7a16d75
SSDEEP

1536:EcTVljTOptsTrtpLOVRuMpF5CHYlTnYb2WCF32ukRIxQvWcpOmYIO:ZVljCptQrGHF5CHYlTnYYF32uWD+mC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2032	AcroRd32.exe
2032	AcroRd32.exe
2032	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ead2660022c80fa664aa704ac2e30f54_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6f21dd5aafb37a9ab1b495104dcdba3f

SHA1
a5584b530d9218cda128059b0f2b33698f2c0176

SHA256
c08e4571b7344a669f371ce98e3c95ddfe2a683c0646cae8601e3a4742b375fc

SHA512
2adcbf29be4726150ea2d1f6a88c6c92f36f99ff91ddd064edcc16a0f04e38f7eea85abb20b4d9ada3dcbd17ecae5c397ab7586d078f1c6673a24eb50bbbdd8d

Download Submit