1e62bff8a02f6d79abf5e7835827c676268e3eb75a1d159efcc63d4ae14c3125

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2851520131b0d3e6895b5c7f4ed5b1c3_JaffaCakes118.pdf
Size

145KB
MD5

2851520131b0d3e6895b5c7f4ed5b1c3
SHA1

b04f7f752dbf89f6097e38e192fe3469076cdbe9
SHA256

1e62bff8a02f6d79abf5e7835827c676268e3eb75a1d159efcc63d4ae14c3125
SHA512

513106fc8dd560127bb2f6017cfc765fcbb666fff5651cd0970e5771300438a41fccf2af883d732611f739b0044313f2ab57b06cef5c7eb965e114f659e9330f
SSDEEP

3072:XLvvxlz1aysJW4/vcinmyOqCFpNK5zKxnG7qEetoaEI1CQLGgQceM3:XLvnJayXRyLm0247qEetdEIecp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2116	AcroRd32.exe
2116	AcroRd32.exe
2116	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2851520131b0d3e6895b5c7f4ed5b1c3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6b962e81e3b3e15031d7c7b73e332922

SHA1
bf25d69b869ebbd599f12970472d2454e5a8da38

SHA256
b94cb63a1bdfc88ddcdd211ecdd90ccba687905ed6bae6fbb7d19e1408495ac2

SHA512
daacfe7ad2ee545ac12cd431097de63f8cef8b63e19c06e3f146e35752acb92854bf32fb935a5bd8ff8a8f4df1b4110336ab6baec1e576540e18eb71f07c4961

Download Submit