0f79fe0a04700e94c9ece75363a1eb8b61b7801dc27c1f052cbaed03db611cec

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ad4c998026371b3cf3236b649156759_JaffaCakes118.pdf
Size

78KB
MD5

2ad4c998026371b3cf3236b649156759
SHA1

9fb422ed98bf2378ffabb64ad6e88b54e3330722
SHA256

0f79fe0a04700e94c9ece75363a1eb8b61b7801dc27c1f052cbaed03db611cec
SHA512

9fe4b06c55ac9266b6b2721ba243f0d5a49cd66849df0f15b0f2a93728e94842ad8bfdfa5ed5cdc72e79eb06abbe119d397a36e936f57be8d00b52d09e4c1f37
SSDEEP

1536:VHteCOaRGZtzWbLMc+D2wG2Wss9KDU3rgBFw8Ojqe07TzbWspO2Xwk:xtxGZALM9Frw3Uw8OjY7Hm23

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2480	AcroRd32.exe
2480	AcroRd32.exe
2480	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2ad4c998026371b3cf3236b649156759_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ddcd03701f513daa59c53f5fc3730289

SHA1
d242f64e8e3b9469091bf6ca987c694a49ac77ff

SHA256
685d0aa5f3ae54cd6763327fc39bdf4dddaa06b07bdc9975080d760c76e9d246

SHA512
ea9d4db5764a82e98fbcff9100593df977154e33e23b3df67fdf799c7307e6f5b036182962770d9bade21e539905fb127d34ac8fd5294b3dabbb29c7093e4a60

Download Submit