d8ccd7d6f04ea80a802756e9a815ac5dfb426d348b8e8ed6c5acc22d73e8f268

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1190fa4329d8611c69d2ab7d45a153f6_JaffaCakes118.pdf
Size

81KB
MD5

1190fa4329d8611c69d2ab7d45a153f6
SHA1

32f2d8240cdf51f7d6becef8f0408cb0dbab6b6d
SHA256

d8ccd7d6f04ea80a802756e9a815ac5dfb426d348b8e8ed6c5acc22d73e8f268
SHA512

74be4067b7288be78af2c9d0b9cccf2cbbf82c3a8c2c37f72c334e6e46709f2919a5ce7553352dd187b94f7f38dd99b9fa417426a1e01a24080c3be879797eb1
SSDEEP

1536:W6VaXeXGNnWKgGn53ia+DKwHYZEyAUxcJa/T5BXnpUUFu756WU8B1FcWspO2kWC:BVamGJWKgGODKwAECcsr5By531FP28

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1190fa4329d8611c69d2ab7d45a153f6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
982c4d58fc0382c48ef4168087c5a7a8

SHA1
28e8152586a3fd8655c419f81e514a4110bb5655

SHA256
85456d48adc603ae3cdb8dadbcaf5c01ecbfefd909703e38fe827e922ad79f39

SHA512
4024d51199f4281baa10c190d2fe681e233ec8c87e0ab1c06c007e37948691ce124d092bb6dff6d4679473e1273953a5f78d4200952b0b88bcad576291cd2ba6

Download Submit