52cff3e939d7c2368feeb3a05273d4f791bf7e2d12ec10fdc950da13c2e82d27

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9809945ae83f769e4c7f1dfc87d2ee7_JaffaCakes118.pdf
Size

43KB
MD5

f9809945ae83f769e4c7f1dfc87d2ee7
SHA1

61b1b20169a94cb7c007d83eaa10d3944aa84d28
SHA256

52cff3e939d7c2368feeb3a05273d4f791bf7e2d12ec10fdc950da13c2e82d27
SHA512

e2e6e764b253a95827613270250d91332c795498a700d6486b96f5508853ed6ecddda40bd3e6e41bdebbed729db4b9e637732e9c980dd28e08df4d8ecc294104
SSDEEP

768:xgGzpD1pB3v1RylEy3c42SaKJaR+Am3J0lkptMG+XtOQ55yBboSq0nf3AW1IK/lw:CGFBp1v1Rw7Ja25JpSVXBmbJq6f3AWy9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2052	AcroRd32.exe
2052	AcroRd32.exe
2052	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f9809945ae83f769e4c7f1dfc87d2ee7_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a08f770aa22d589b21ac849c409894f9

SHA1
b72e138fbd63f82a42a4d9aa8c9aae1095cdf13e

SHA256
80099c462b8049b716e52fc7ef8134c2f5160ce45e6e41bc39691a641e47bdbf

SHA512
75f7fbc5606cca40c78bb7d92656c2a188c1fa5c66facc207ea63e3d6863e032f855024b735fb9e7633045da82cf01e33961ff70a1527a5af305fb7544dd3d55

Download Submit