ab6e1583d7dd95b2fc4b6b9e5db5f0910a5ad7e0f886e9ecab3a692050b8767c

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2996c96e118b347428e478f77bc171fb_JaffaCakes118.pdf
Size

74KB
MD5

2996c96e118b347428e478f77bc171fb
SHA1

bdac641492e8ff14cea70eb412313f3739689311
SHA256

ab6e1583d7dd95b2fc4b6b9e5db5f0910a5ad7e0f886e9ecab3a692050b8767c
SHA512

ad12b4637118e03a374db64b68efa19b6fe57740bb9de5649f7e2c87adb819c536d929f3932018a778ca402a34eb815cb04216fd12c455bbbe09a6c31dc6b804
SSDEEP

1536:0WsQh+lHhDRLLF2gpe4K9YN0dRIt96XQ0PS7mIDtLvaIA9kqI2DdPJ6A0Mzw6:aU85Agp6dRO9x8kDJS0DW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3000	AcroRd32.exe
3000	AcroRd32.exe
3000	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2996c96e118b347428e478f77bc171fb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4371f3cc3f5ffa0bc696c75e147eb422

SHA1
6528432c453b5c524d25e28e9d4789a3dc9edf62

SHA256
e03169ff5f30d9625c66672ad61556f53bb1f44e44878efb83ba6e2fe446c1d4

SHA512
ae9a182d20121d4d2c52bfb7dad3c2e6e8c5a712d8d72cddf02a9d161aeb4fc3210a6c77ac41a205bfce8d9315c5408e1d78513809e789e7044e39e3be32a8f5

Download Submit