f410bccd89756ba0fff22d935e9e231b6e77270c0715ec13a95e89f6f1b854d9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

14d56b6abee317006a80ec674a37ad61_JaffaCakes118.pdf
Size

96KB
MD5

14d56b6abee317006a80ec674a37ad61
SHA1

9f8c1bf9576154be5d70e4cd3c6e53ee88ee65da
SHA256

f410bccd89756ba0fff22d935e9e231b6e77270c0715ec13a95e89f6f1b854d9
SHA512

2313e09c0da8e21cc1e4743725a7c8821dffb6fdda89fbf830ecdbce34fc2bfd2833d6a67c9fc5b77e1e438ea68948b1d44d01d2de29d591faca187939d0f1a9
SSDEEP

3072:AeHk0oi4qMu9uO5KPPNR4NJcqU25oXSwE2VO:n/oi4qp9y3B6CO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2264	AcroRd32.exe
2264	AcroRd32.exe
2264	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\14d56b6abee317006a80ec674a37ad61_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a93a380c3315e2be052e1904a611b15f

SHA1
0e6a56f7eddb111b59044c2b1e5ef45729d533ea

SHA256
f112fbcd7cc0e21a07b01698b45fc63ce970579d66f70e5218b41bcadad4a50c

SHA512
1495e38df863447126806d1663ded1d50b3dfaeba0f58f651c4723798dcf346836bacc8f563fc3a7804c42f89509fdd59e986235a9ce3f77c3a426f84e241e5b

Download Submit