52651c8254cb9ae559f14376649da82c5dcf9c453fd4bf7f3af62f6e76944d31

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2680545cdc1e9fa98bfdb8ffcb4fc15d_JaffaCakes118.pdf
Size

95KB
MD5

2680545cdc1e9fa98bfdb8ffcb4fc15d
SHA1

c2b34030096a1eeb15d2d541acc5a7caacb8847b
SHA256

52651c8254cb9ae559f14376649da82c5dcf9c453fd4bf7f3af62f6e76944d31
SHA512

2dee37c17562ec39a3d371867979245c53dfdafaa73a77624b9a58ef85103ad8074f9d6601e6c9c8f5efa263249444de2eb077d49d741b84379871eb6c6fffe1
SSDEEP

1536:haW+yh2oUS2Qn/a9wIHo3IZD6H2626wIsbg4rgpVJUy4FpYiFyhtsqgHKiWarowq:0WThHDS9wX3IZD6Fpfb4MpVJx4FpYI4H

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	AcroRd32.exe
2380	AcroRd32.exe
2380	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2680545cdc1e9fa98bfdb8ffcb4fc15d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8fa654fd0f1e8ed6f5d2d1d74df1ffd7

SHA1
10fbc3164bfb86b9c4c149baaa0a7ee63ed82423

SHA256
1fae1c729eb374bf4b91ac8e26a87a9ed2c40c949ea425d91d2ffd0fdf3a3d20

SHA512
91e0b7d61572eab4ea61434daec1a7ed39bc367d26db3480c992cd9187e8156a09ce0d16f86590c8c63d8e2ed1d1dc1d145eccff172881802a2e6f643590202f

Download Submit