303cee86fe5123ee1f174e843b2731f8157562261f719a230ee41f7a719deeda

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f043c48ae1712f973fd6f89c9b7c9a90_JaffaCakes118.pdf
Size

41KB
MD5

f043c48ae1712f973fd6f89c9b7c9a90
SHA1

2b1fa1a6fee8a8abe245a22fd1e93aacd7c00baf
SHA256

303cee86fe5123ee1f174e843b2731f8157562261f719a230ee41f7a719deeda
SHA512

500a1556977eda76c3bd2802e3fc1b6d8f9f1241c2a6ab386093c572f4f7e7b3c1dadc74f48e14970bc8910729d8d792d1d50f0fafc89bc3d3996249b7f75c4b
SSDEEP

768:G25KyjbxlykW6XV7vJPfR/BBC7qA7Ve2+WcmdD4JHnOkX7goNTQT/CXm0QIYDXB4:GABjlMAh4TUOc6DdYe6Z2dQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2796	AcroRd32.exe
2796	AcroRd32.exe
2796	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f043c48ae1712f973fd6f89c9b7c9a90_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3109ac86caeeba1f5aeaf3568583258b

SHA1
da388c416833a005aaea558bc337c56332da3e55

SHA256
a5ce81c4619b7c33e8a55d34f8c8913cab6520a4c86631e32f357075f68c6c51

SHA512
8ed5312deb15ed2ded4004ca736376e4a8e29ff0e71b3dc0d63fdb1c627b6b3091d70af173619d83c6efc37d714e8ad35ecd433d1082b4eb15d3b9f4e62125c0

Download Submit