f4a9876ff2fb6d4fc7d9130d977ab0c9ab822a507dfeb31739bfd2e73cf9a3d9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a3d4658a8ac8b65a02416c62a2e7d4d_JaffaCakes118.pdf
Size

73KB
MD5

2a3d4658a8ac8b65a02416c62a2e7d4d
SHA1

fb7c02b261a1703c008bbcd8806620d28ef0b3f7
SHA256

f4a9876ff2fb6d4fc7d9130d977ab0c9ab822a507dfeb31739bfd2e73cf9a3d9
SHA512

9e4df96faf65ad2beb2820b1c308a75f577363fee678e7785ac30654f301d7878acb1f73b08e818e9f837e3d1e1b9942e828d91fe101e78c485ac1c61664b760
SSDEEP

1536:jDcZjSEELj/BwE7spoFTGVBSd4ZZuskQ3nNZotBm4I:y2EEL7yE7dAVBegZuvknNZotkP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2a3d4658a8ac8b65a02416c62a2e7d4d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
36d590bf6e668c4eb4db32d509e2cd79

SHA1
ed2eda0905fc3d9c98096c8e7be9164c75afd1f1

SHA256
5a50516d625c4064dfe3a0001b2479984e844abad7bd85e0d016dcc14baf9166

SHA512
17f24394886678e5ae90a28e2626d2371eb39272924f408afd3d6d62171f79996d60d7c8617fcbaba00336d0dfa7e2f13273618c233207666e7781eae8d60de8

Download Submit