70506fa3e8eac351b7e482e45d80b4c82efedd0841828c64cb161941215a8c0c

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff2c531c45e02d0a33eb05310908ba53_JaffaCakes118.pdf
Size

72KB
MD5

ff2c531c45e02d0a33eb05310908ba53
SHA1

3ef9d2d762f3333b2453f8a11760b6cb28825941
SHA256

70506fa3e8eac351b7e482e45d80b4c82efedd0841828c64cb161941215a8c0c
SHA512

0967d89a87c7503a34cdf185847778f0bd3a6d38283363e2f9927c398f8f0432d2ce077369554758a6b027d58f5d07781b8b9a45c70ac76d183ba5930119af2c
SSDEEP

1536:cGFoJ5XyHdGA4trJWdI5qlxloByIZxN5NGv:5Fo3CSJWdI5i4IIZxN5A

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2112	AcroRd32.exe
2112	AcroRd32.exe
2112	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff2c531c45e02d0a33eb05310908ba53_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4267338cf3e6c09362d0d25f07d4d82c

SHA1
29eac273d298f1f85de1bad82ea13e2ecc7c50d1

SHA256
dc61847d430daaf89868c481252576d85496adce77f0a2a9a06ec4a733e69941

SHA512
8b50dab8412fa7e860502a509aea6e7014abee355615ca8813b71264e24d20b73af23c0ecc5cc012f5b945996483713e56983a4984b36377ff12828f34390ccd

Download Submit