796459489c64ceb789ffe8b99f1efc14971ccf7021cb6928a0ca6ddff881c609

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26cd3d8c8bfbfac4342b85172f128c11_JaffaCakes118.pdf
Size

79KB
MD5

26cd3d8c8bfbfac4342b85172f128c11
SHA1

2264971b7fbe2633854625c3e22347ba39be4404
SHA256

796459489c64ceb789ffe8b99f1efc14971ccf7021cb6928a0ca6ddff881c609
SHA512

ad22b8d0ee44ad37a413df46398a607ce6ac6fa449d85e9a9e0ad4730507a03c95eb37e18a3ed4535e87c6171fa5f7aead7375fc20a6d6c3d2874bd36e58482e
SSDEEP

1536:HU3DaePosm6NSLzN0dW97qgRCIT7MSAb0d4WnY2aVWVi9Q+f+njDhYrWQpOCGrIH:03DpJNoNTMSUmgQt5YWCh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\26cd3d8c8bfbfac4342b85172f128c11_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a0917ecee31bb6ade96af7f1cc77a178

SHA1
75b0876c6667b787eb6d727cba676c0362b539c6

SHA256
e23e4d9fd112c15890f02415f45946fa7dc55001e6495618ea1faeee9053b172

SHA512
f9205fb1dbfa0405f3987fc9bba918889ffb6ac8bca012221fb1254693c0cc4e90b33c51f65f575377b53d179e2e0e77e15fc9ea89783082b9f761126419a4bf

Download Submit