1a1445f9bc7f315fbffcaf396ebf91dece11882bb333ec9b9c39a733a4b95406

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14a2a8f4485c44470258cb375f7d3e67_JaffaCakes118.pdf
Size

77KB
MD5

14a2a8f4485c44470258cb375f7d3e67
SHA1

dd61c480119427491d1157afa20b6aaaeb8b9f73
SHA256

1a1445f9bc7f315fbffcaf396ebf91dece11882bb333ec9b9c39a733a4b95406
SHA512

8c93c9ef91e40bc6e11e150d2c6b16e11d336104a5ab521322be1e01817277a8e87efd806263b692db74ce06ff0e2518b01917bd168dac697eede7df07c2cf6c
SSDEEP

1536:gWDtvjxRjIo3sru1zbt9puAd0RtgmJrnfXDefY38GoAfUxSNh:ZxRjPcrSt9pMRtHTvDyYsfAfi+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe
2668	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\14a2a8f4485c44470258cb375f7d3e67_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
236fddb0d49243bfba46986f265abcde

SHA1
37f0caef001e26d7df9097617bfb6b34fa970fc8

SHA256
0b5fa77d3588c0df4163939b32e8bcddb05ff7f795a45353706c731433502266

SHA512
1a451ab9d409b3823bf0af4dcdc46ebdffb9769ae4dab1a4afc3cdc544e315d94185eedb4136bfb444a67ce05beaf29ead8d8ab22271e7ea15d32d5c8a86f22f

Download Submit