2cbe8688a10416cda361d21d5d02764ee21e8a505e55d9c43728b75d9281277e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29ce2f4fe457230ba5a8710c785537d9_JaffaCakes118.pdf
Size

47KB
MD5

29ce2f4fe457230ba5a8710c785537d9
SHA1

4bc165246a74c0e3c3df35e53e72faf6c59c7c1d
SHA256

2cbe8688a10416cda361d21d5d02764ee21e8a505e55d9c43728b75d9281277e
SHA512

abe47854ff70f2cdfda91465c5c335d41a3c2f3a701670a1d01beaf82416eddcbec6cfc157a6051a13d720c41eb6d8bfff4ee18f66414fd9c50ca0d9ae6f6f00
SSDEEP

768:b6wcsfmwXBVkURcWzqtG3FTdD/50FeFNelcoyMs5m8r2iZtLpnuI+4EleSCs:b6x+SUa1MD0FJERDrBLVutNZCs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2172	AcroRd32.exe
2172	AcroRd32.exe
2172	AcroRd32.exe
2172	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\29ce2f4fe457230ba5a8710c785537d9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
de8b36add1195103af6c4edac1ff2ccd

SHA1
d4dbb92691a521c10efc6bad8ac039173a64fde2

SHA256
3000f8f6c5fcd8a7ce8e0aa009314cf207029953d54c18052f76cca12e32312f

SHA512
d9b7d3aab67ff73d4131c6071307e4b412d34f267d727317cd045b5e4512a5042d0ba4491ea9b090d8b9caf42951fccfa07d30f01e4016892a8f8ec3444d4fd4

Download Submit