f5f0fb278bb6a248b2bd5c0455e231dd33e8ef03c0512c4cacc1c77e14277b62

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0321b92db945940817742288123c8536_JaffaCakes118.pdf
Size

89KB
MD5

0321b92db945940817742288123c8536
SHA1

c0b34d8d9e41ba1310aa6542ee426b7016cf6ea9
SHA256

f5f0fb278bb6a248b2bd5c0455e231dd33e8ef03c0512c4cacc1c77e14277b62
SHA512

24a3a7d04e89a9631d928ea1c0fe433d0a418db4351d5b52976f686aaccded31fa828d3db3491682b24f22a9b1a1535f6f8501a51554786fbb5399be0f01ca78
SSDEEP

1536:2Esdy0eIzPxQMXQi8Kh42tYJWotNPR+kH/E5/lnxo+kRClgf4+L/aGuJxCTbw:ROy0fPxx8E418o3PR+M/E5/DoJRCig+O

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0321b92db945940817742288123c8536_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
38554850b31f09e6ea773ff9a9806d80

SHA1
b966ccbb1a200691c743950d5eeef334dd84a7e6

SHA256
c40f300a4232f43d808a088120fefe398e3d6346cf30d0bfc0abc4a79ffea1e3

SHA512
324d14432af4ba4a9ffe68133245620f6de71d2c9a4bea99da94ca22575278956d880b4eac2e448a52cd4d0ff472821c8c5a2c7049a54497c665e7d90c445c96

Download Submit