12eea7bfbc7b30a1be4bb44881b22d6ac4c91589bdac07c920266bcc33d4d513

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14bcd4dc3822dfcc0b774ab5891c4c27_JaffaCakes118.pdf
Size

72KB
MD5

14bcd4dc3822dfcc0b774ab5891c4c27
SHA1

9a197c5d389dad81cabc2e5917b594e41723cf18
SHA256

12eea7bfbc7b30a1be4bb44881b22d6ac4c91589bdac07c920266bcc33d4d513
SHA512

a5fa8fb528c76c99853560a6341cc8be001f7ad193edcdb3c7389db5bab7a95f690bd35af673daddd3f8bae27362837ccf540189e62fa3b8d9cb768d5689d078
SSDEEP

1536:WYPt5mFZuI0RRLsUNi8s4wurFuIw+JQ1ywMBuyxd6sUnwrZcG0WHSK:Z6FZj0H84wupuIwbI/cyxd6GeGGK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3004	AcroRd32.exe
3004	AcroRd32.exe
3004	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\14bcd4dc3822dfcc0b774ab5891c4c27_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f7ef21c0448e741be0ba0149990009d1

SHA1
65bcf63ac809b2fdc1cb8d570e3addc284254e13

SHA256
5db9a06a26d99a3d4e758620285b08ef9588b5d8452b8aef59f73fd8ed62ae2a

SHA512
c3c5e52ce631266c68590e26ced928544687d9e80c49c8dc7bf09e688f1db6fbb331e96b1f43653bbf0a9d119f4fa2dadf33a4b4003aaa98171cdbde16a0214e

Download Submit