4b737ed927976a77a6235187b4fc52bdd3e2034beb2ebb4db1d1affa5d25d070

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2841fc50b472959143c3f6d725c917be_JaffaCakes118.pdf
Size

73KB
MD5

2841fc50b472959143c3f6d725c917be
SHA1

dcad341e2f59c8be5349775cee2b690843d50070
SHA256

4b737ed927976a77a6235187b4fc52bdd3e2034beb2ebb4db1d1affa5d25d070
SHA512

d38ff98253b66922fb2ec3b91c8d3292cd0a4085eb7e5c62694fc939c300aadfbf9fee3affdeb07fa5a8e450d469417ca88bea92403ac19d8727664e34acbc38
SSDEEP

1536:Pq+jTzm+PdunMUXCLujgAiDor8XsNa7OxlKgTK5NPKHbQr:vDm+FdEgA4ojlKgTKPoo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2841fc50b472959143c3f6d725c917be_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2c7bbb353e7f5c942131f9ce06e19bb0

SHA1
33833e5f7c0a85f6663ef06112481ba937f242e3

SHA256
fda3f21749c8b3fa5fa783fafb924eac24a11a50f984227a0d6e3357387bc075

SHA512
b10be1b44c424171b440e4f94885c0f31eb9179bc6f6b91d575f2c49b5fef703ed0d430ee701d8f6a52cd763b2c850d61aada2160f14f582108a6714ec2d8c37

Download Submit