0937db94f9314b3bb3adddbe10decae6668d2ffef4cde7cc3ba1ad37974ae723

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f030d4df0c8d9841618ffbc7e5c21769_JaffaCakes118.pdf
Size

79KB
MD5

f030d4df0c8d9841618ffbc7e5c21769
SHA1

31a97a333a17af66beb0bcec01fca18aab1048b9
SHA256

0937db94f9314b3bb3adddbe10decae6668d2ffef4cde7cc3ba1ad37974ae723
SHA512

8507e82833f4a59f61cc4717811e2ce19903844292a089874a866c1df4492c20b1cfb2528a489c3e0975a4ca018783ffa42717bfae4ae626b1140d9ddfb6829f
SSDEEP

1536:KXFZmGWS3BNB1OHjut2UUhvq+MuNiQIx4Z/3uMT5/BH60vh80xEWaMF0KAAS7s9h:Ays3BRclZhquMo9eObAAS70pdh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	AcroRd32.exe
1716	AcroRd32.exe
1716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f030d4df0c8d9841618ffbc7e5c21769_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
672ba78494a0873c6da18390cba4e0db

SHA1
3c0a12afd64e7da187ea7a5b830714f521561e4e

SHA256
004feb9cca122c07e8c63faaf1f22422fe3a490f7f0196c521b3351c747157eb

SHA512
e9ec30aab17f836939722bb095211ed2707db6da84ce2d354077425d4819707ed7e36c718027a395f964ec2269afd3b4d45df598a301377791e2f55774074439

Download Submit