99933f9352c7e1db8943dbaa5513804fb57d52bdbaee68c72a1a5e6b26654623

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f048a4efaed70340fbf48b0e8ce7db9b_JaffaCakes118.pdf
Size

45KB
MD5

f048a4efaed70340fbf48b0e8ce7db9b
SHA1

a3ef2fac1d8556df0a19882254636613ea7f812a
SHA256

99933f9352c7e1db8943dbaa5513804fb57d52bdbaee68c72a1a5e6b26654623
SHA512

faa4f10f6238f7d68cbc4164972e6818b8c6b2e93e2d2d31be0df398e29852f7467cd76e9b46af69b48efa808f01a3141d600f1b4d569c217f72dae836557301
SSDEEP

768:ubgGzpDipiRSuK+J5aNwSLU3LFMgOFOd5FygzlvKMvWME9tXZsfUAuCN5WDM01eE:fGF+piRuN7LMmFUAZIuCWRhl6M6U

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2080	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2080	AcroRd32.exe
2080	AcroRd32.exe
2080	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f048a4efaed70340fbf48b0e8ce7db9b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2c1b4b75037a78fcc91ce49508548131

SHA1
d951de28d80933cd36ce1830ef4337f39d706859

SHA256
08db00eba8332476cf570783a1526ba6a13f98543d6a753a86e31ef70ec3f817

SHA512
cb83781d2d9af59dbf75e61b5960b7d32c1b6935a920ce62a5b7a2970867f68d45ecec976b8327516ea7a53cdaa50733af016490d03860efe2a58dbc7bfbea6b

Download Submit