adc3d19329600efd25a2d538f96d59484a5da571b3ab9386589fac96fb05ba4b

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04e4aa99c4b06b64238c3de5a105b2f8_JaffaCakes118.pdf
Size

86KB
MD5

04e4aa99c4b06b64238c3de5a105b2f8
SHA1

718cad9ae9472765306857d2ffd357a1dac2c46a
SHA256

adc3d19329600efd25a2d538f96d59484a5da571b3ab9386589fac96fb05ba4b
SHA512

62fcccea7f062c79ca2b59a57266bc1e7c7ed176d9f71d17dea9aba82edb0cac204b4d4636935fed45d920077271d64e61f34d2d12af5d3260cc7936489a93bd
SSDEEP

1536:UlsPIUViGudUWAQrDj0KQrSqIHwvdb3lmUbdWHH7TT7lWapOtQAFLl:8sgU4jJiN2MGb7atQA7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2112	AcroRd32.exe
2112	AcroRd32.exe
2112	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\04e4aa99c4b06b64238c3de5a105b2f8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7948d7131c22e7fc0e9691825b1ede05

SHA1
d1e8a8c0f0cd8d883beb4ba2a3df4073b30260cc

SHA256
67ffd5992497f380e21ccc2b6ca70d0e47742ae28e7a7dde29589de55982bf13

SHA512
0fc629f7ddf53fd32e7260473f1fa27000bf3915e86055b8d8135e4fadd478bfe50e6eea3b2c339d8f4f3c750ba85d1c0dd14e67cf25986de8fccd6d19aabd56

Download Submit