a11216eda0e99f36d787d4774ef095009d1133d09336a61a63cc0a5570dc027b

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f67130f0b1949a0f9f26015ae9300df9_JaffaCakes118.pdf
Size

57KB
MD5

f67130f0b1949a0f9f26015ae9300df9
SHA1

6ffb7feb41a7f1488676b258de30d8eecb3d4a35
SHA256

a11216eda0e99f36d787d4774ef095009d1133d09336a61a63cc0a5570dc027b
SHA512

4050c1f4e38d2b18b63974feac5dc4af6796b2ebd4690eb4fda1555e9c5dcffd8e78349768e2643f1e3627591188114700b91ff560d9cbc959d23ca604ffcf47
SSDEEP

1536:xdQp0sIj8vLgGsUZIOVG+w4v6bYGE+76CO3e0TtBoTD2w3UrB4oSZUIcoHvhxfjC:xmPiWkHob4DC4D7upOytBEPiCh1PL7pk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
740	AcroRd32.exe
740	AcroRd32.exe
740	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f67130f0b1949a0f9f26015ae9300df9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
19daf9ec8f4cab46fe937baf3975ad34

SHA1
0282a9387e07f005e850d797694dbaead643d8a7

SHA256
76e0485d5ab9e76900a467c55ee19b88b9a360b1498beb03f170432c9802d53c

SHA512
fc709d3fd2b60e2655cb8289c6fc811a941a262ab7090f366f3352f0277de7d951713444fb5f597600e11a164f68bd4cebc992a2ffb111b6b3471df755bbd361

Download Submit