32e598c50e6d7f9a8c5fa23e5d3bbcaa14a8ccddfbd7692e5e7d06cc72de7658

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 05:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1656267b1c4dfef4fa45d26cd8e4371b_JaffaCakes118.pdf
Size

83KB
MD5

1656267b1c4dfef4fa45d26cd8e4371b
SHA1

94df60f3ad67ea6fe347513ce2c808256646c316
SHA256

32e598c50e6d7f9a8c5fa23e5d3bbcaa14a8ccddfbd7692e5e7d06cc72de7658
SHA512

3e53fc01e90281dc7d3691a75684fc17185d5f899977761d5d048032aa3b671544c8be37df69b5d312bb9ba715158dbc2d8b9060f80795bd13d74e1ee495af33
SSDEEP

1536:FZmOLatqMiY8WNos547z9DENm5AoYcrxW8pOGEWVLX2R+Kr1eWAxS1Beo4H:xatxiYg75DyWxYcr0Gx6R+KeWAx8u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2420	AcroRd32.exe
2420	AcroRd32.exe
2420	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1656267b1c4dfef4fa45d26cd8e4371b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d46719044feda5b59b95210f9590c5b0

SHA1
775ab96c6db6bb48dc725ccc1a2a2e4a5438859e

SHA256
453e57bf66becb70fa4143888a9d2794af47381ef8c152d8faeda839b6a9c5f1

SHA512
290243c55346ebe140537d8840dc5dbde65918b2b51e0c7f26160b3c45962c9dbebbf7133a02fa4a135377e1e0253fb47771ae975bfe408a0c8e8e442c4dc5e1

Download Submit