24a03dc30cd5105757d423ea37cd3fbc6ba3102eb1911519414c0dd6c5a0c9bf

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

111add73775edf6ad894d90347e1c9fd_JaffaCakes118.pdf
Size

40KB
MD5

111add73775edf6ad894d90347e1c9fd
SHA1

d71d206d4a74f47d05fd61e37b1b9b4c478f9c70
SHA256

24a03dc30cd5105757d423ea37cd3fbc6ba3102eb1911519414c0dd6c5a0c9bf
SHA512

de618a54501a452b189177f40eb49aaf9ca596af98eaf4b7566c1f2d55f0683e67a4a58653670bf9c84b75d95a855d6bdf39de6f05df8ae12fec029f502899f9
SSDEEP

768:ggGzpDW3jp1Cnc8+3C6SxO2CDuPuryMc0/e9AkSxo4uKb4X9zs:tGFqoOhuWmMLe9AkS64xb4XVs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\111add73775edf6ad894d90347e1c9fd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30d39ea6e588c4fa79455b8a2f982182

SHA1
d99f685bbd32aa05befa9eb59ad60067ff4a4a52

SHA256
95e6cbc2872d425b45360d58bacce6567bbb11cf70af79d99201c2394f0c0643

SHA512
e8c64ec6e94197d437ea08e8a260315e5fc9f3c8c9cbbc0f1372e34206b8ce97fe74a4db6eb6e44c37d1a9c5eceee22f19c22685359799cd08432cc9c7139b68

Download Submit