1be841291f5c6d38d4d1828f31bae6fe92f4f89da48603754ff1f5e30ea594b7

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

136d550a31031dc56890d175cd1b6f2f_JaffaCakes118.pdf
Size

129KB
MD5

136d550a31031dc56890d175cd1b6f2f
SHA1

febbb446fb12f87c2c285852d093bc7e6a996739
SHA256

1be841291f5c6d38d4d1828f31bae6fe92f4f89da48603754ff1f5e30ea594b7
SHA512

0bfb3a99319aacfde899a4cfc6a85db8b053b72bc3b42cd9d87352979844fb3cd4f23f57fac64a13f82eed6c623889b2d9a21cfd9d12f805dda9ef59972ad05f
SSDEEP

3072:n8NcgC9CXDaxoPRJBWepOCuA8uKGr7b+q5ne1M9+eee3:85XGxoPRPtzr8CX6q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2316	AcroRd32.exe
2316	AcroRd32.exe
2316	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\136d550a31031dc56890d175cd1b6f2f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
507fcfcced723b234836d232efd4cf30

SHA1
f94b17658b674be9a94d75e13f6939441b8fdd9c

SHA256
743992b33e46904ed1d5ac423ed0a4f279c37ccdc0977ff5ef89d7f871d29cf8

SHA512
61be090c36b086ef124622e8443650cc7dd5d6362b0ab76befb636f8ba302a5735cf5298328bd16305a0a4fb65e97b59754f97bc8b06156035986f8d5e42d5fa

Download Submit