82b8a7764f1cdc195ec8735c43de779757f5ea6487d7e0d4add311909bc3d114

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 20:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0333d6c9ff8e8e05d920c9f29371fa48_JaffaCakes118.pdf
Size

76KB
MD5

0333d6c9ff8e8e05d920c9f29371fa48
SHA1

91c8cdb3a27fc2645d798ef88a2ae90103df076f
SHA256

82b8a7764f1cdc195ec8735c43de779757f5ea6487d7e0d4add311909bc3d114
SHA512

2da8f5ccd50e83596c2c0bed490675dc527e9ca46360cc89e5cc805aacaa7dccd205b157bcd23f52927dac545c41f4bc8271a88a75dda36ebbe07cf45f177043
SSDEEP

1536:pwpNx5awOvFII6WlNMdxQWhogAO2JrWGpOKCWfBov0SFA3q3gd1uoQ:SzTaiICd6WaDO3KVBQ0SFkq3yO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0333d6c9ff8e8e05d920c9f29371fa48_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8c4f339b022f1ecbc429777b90656217

SHA1
fdfe2c4890a6acfd4de2452811622b9a69b8c903

SHA256
b93f9530a6054d35a4891e96a8e688c608dcf9011a4315b6c2fa677d24fec7aa

SHA512
33a4aec6357f9e4d0f35d3688d6e48e28357eedb44ac8cd6a0527cf5b0db5834962dfdf1a8f8411eece0787b4cd9d7194d2384ab8c3dbc19fb3430b2a40d3f79

Download Submit