79b9e817d6ece3a2a33187bc6fd60900d52b4ad7b90312cc000793e7f276bf9d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 23:33 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

271742423583cf230c207ae01c2baa10_JaffaCakes118.pdf
Size

76KB
MD5

271742423583cf230c207ae01c2baa10
SHA1

c529dd451f12ed4a02d929ff981c838ab52ca02d
SHA256

79b9e817d6ece3a2a33187bc6fd60900d52b4ad7b90312cc000793e7f276bf9d
SHA512

5ee473728f9c30bdd5c212340d43f8c4093962626eaaf66907f6fe76611cb16fa597f6e24c0e5d30d43f7b162b9ecc571376353e7f1d065ced736417449bbd71
SSDEEP

1536:jibJVIKIfk8tfSQjJLiH7MDjf/4wnBAGeEM:iz6fkA/LiHcjf/4wnBAGq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe
2656	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\271742423583cf230c207ae01c2baa10_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2362211293100d7ac3ce355a50c37796

SHA1
a3441513976fcbe4832d595a0fdeac01f4dfa351

SHA256
1a686e98c473923f77405f7e63f9abd73d20674cc2e6d57768b811226b3c21b6

SHA512
4809918e7dc2f146c2c78ae6d11b5ef6eb38d5842efc8427dc065ccf66ae1ef4c9a6a760339b37311236fed44c152cfc4cf079c677c6c08df360dd3ec69cfb97

Download Submit