5f65468e722e4bf2be1d4eb91b6876f933b3fab7049ef7cfc2f02ac5b460fd36

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

043509ec0f995830a4efeffdc06060b3_JaffaCakes118.pdf
Size

79KB
MD5

043509ec0f995830a4efeffdc06060b3
SHA1

2a83ba2595bdeec84ad73568549e6454ba1b78fb
SHA256

5f65468e722e4bf2be1d4eb91b6876f933b3fab7049ef7cfc2f02ac5b460fd36
SHA512

01065dfdad8d6490f6d3a29930086b0374fb9e2beb6cbbdcc7c4c2fa1ebb2150698757134b05a40324b95728f1aa1e48f43cf28285dd5a5b7380fe0a2885d48c
SSDEEP

1536:gHfJSY5lNosYdOihQ8d7dIQI65olAq4bTw3/WapOtQHW3/UVizaKe:aJodNj9dIQylAq4bM3QtQ+UViz2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2372	AcroRd32.exe
2372	AcroRd32.exe
2372	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\043509ec0f995830a4efeffdc06060b3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f1665f480d5ceb318561300d986f503f

SHA1
14fca3f5acbda52a672b3ac07e6037233ed81b64

SHA256
97ee75143f4f365aa06af9d9ec75dcffb57734805846803960d10274527d25f2

SHA512
80795e7127886945396d7d364237a84a2edf7bf328575170248461c6e1baa04d30d79ada0bd4c1c59976de2341642e7851d9d61930678fbaf23e5293e36e1042

Download Submit