c6b79208351445b9baf03e3260d1af8fd6a4fff74f2233595b50c2b7d460c62f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10421db1f9937effdb37d4ff84114020_JaffaCakes118.pdf
Size

94KB
MD5

10421db1f9937effdb37d4ff84114020
SHA1

51e5d967e2ff156d530169073985684eaeb485e6
SHA256

c6b79208351445b9baf03e3260d1af8fd6a4fff74f2233595b50c2b7d460c62f
SHA512

32d905b299c32774c383916d122332a9ed14445b983a69473303ce1c8e636dd74dfa8435946ccd391f497922f11c729717f23e5f28e1bdfc6dfb0f67d3ddede2
SSDEEP

1536:bzjUm1LfmZQi8iC0UoS5G5NZylvdV3+qwjkeTCKmihAF4WB88qWGpOKCWGOGmj34:zrmKi7C0UaNqVuqwjke2Kmihm4WBnTKY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10421db1f9937effdb37d4ff84114020_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
44afe8510432120fc3986dca8bf3b946

SHA1
246f88dde4f23a98c758b85866a7c497e8def93d

SHA256
ef5bb236583e2d5e0e9ee8e7c0532be5e2baf6a22419d0d951c21c311e9c532c

SHA512
dca2c42fb387cdf731eb623ad2968970f18de2872df7ce80008f899aa499b8b74646254c5793484011bf5efbab28c980692bbaff7bb316a417f4c26d00695fab

Download Submit