f10c4a126b4b3c97658cf150d087978f87674f4fd7f954a95aaa2e50e261f6a6

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12ae7882afb945ea81240e765c468e33_JaffaCakes118.pdf
Size

83KB
MD5

12ae7882afb945ea81240e765c468e33
SHA1

62bf4f4c89ef9926f7cf641b35e943faaa3f527a
SHA256

f10c4a126b4b3c97658cf150d087978f87674f4fd7f954a95aaa2e50e261f6a6
SHA512

0d407abcdb2707e4344a36598408d7e9420fe1ed3273fffbc8ed6cc2028fbc772651da1f37099c309ad0ed861f58521bda626890dfcb6a767482c121a0644777
SSDEEP

1536:lxgicp/xmaAhs3nwHR0oKw8moh37QQkTGhiBH4kypWUJZez/oEgW6pOu22KukU:Dglg2jdZp3abBYfm/oEJu22KQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\12ae7882afb945ea81240e765c468e33_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7cc4eab10a9ac99c6eab7acf8caa8581

SHA1
8959fa10bd3609a96fe2028c14c679ae5087403a

SHA256
88f63b43f4732c1c7d430ab63a225eeea31b06396d5359eaf9c8ba7b19bb42f1

SHA512
4f3c05491b46796c7fc858ce65493d93df5d41b5ec5eabc17fac0ace4174bf7cc3c9062c578a51cbba2bbeb8740fc5e01dd0d501e11d757db83fd5eaf29f756e

Download Submit