49969b7066417cfc7901e862cfa4d4ec2df982729e66d8f6a126d66b8a307a91

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ae86397e6087eb4ca4cf602a9e5f045_JaffaCakes118.pdf
Size

84KB
MD5

2ae86397e6087eb4ca4cf602a9e5f045
SHA1

55f6eb211cd293b59237ec2c940002d2d33031b9
SHA256

49969b7066417cfc7901e862cfa4d4ec2df982729e66d8f6a126d66b8a307a91
SHA512

7733cc3c50ad8bfa4ef5b4bfed482bd237c7fa3d77592aca1d002a292c5acf264923adc8466eb92dca69ed61e281b0bfa0afdb79487f056448a8a21df5ff6934
SSDEEP

1536:PZFfc829AdfEk+nYUYj4D7oVhwkPRnzSllWOpOaZIw6O/Wnmw1Nod5VY3oV:jfom8EN4D76hwkZz4eaZIDO8m0N9G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2ae86397e6087eb4ca4cf602a9e5f045_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
356b72e06065091017b9d3538babb142

SHA1
eea1d6278d24df3fecb2da765d518a72e40e9425

SHA256
f9d75bacc508f0acafb0e37c50a7d6895d41d6f2c9823d26a06e8f54fecc5ae1

SHA512
f9ca7e5052085e86d47cd4241b3fd88d34208873093544bf3f4e37d92d3bf9f1300c054c0a872a9f119b0f0c325f7f249363dec0a988058b296055b541606fb2

Download Submit