f985c1e11baeb2adf08ad1f16c70bf4c0f2c3cb77ed9b0b79c00679ecccdedf7

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a9d92ea420e721daee1686af1b176d5_JaffaCakes118.pdf
Size

78KB
MD5

2a9d92ea420e721daee1686af1b176d5
SHA1

0419b67ac435f8e9b7907b45f9cbd784520c5d4d
SHA256

f985c1e11baeb2adf08ad1f16c70bf4c0f2c3cb77ed9b0b79c00679ecccdedf7
SHA512

6ec7fe22fd71da05b733273c47d8afccab922b54e6df8f59ee8241d493b44215508a5731440afee136031665c9de609bd7bd1ac5d3e887a130b548287cc8ada8
SSDEEP

1536:E62LaZUeXJVpGv3zQYdLyD6fk1xmUrWyFo6ZOWPiQgkAWmpOSX6uX:blhJVpGrxdLy6kHMKxgk1S9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2808	AcroRd32.exe
2808	AcroRd32.exe
2808	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2a9d92ea420e721daee1686af1b176d5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
600708853fe9a13d68eb73e986b96de8

SHA1
f5370e6635a8220c7d628b86d6bdb552485d0ff7

SHA256
f44670b1cc5e2e922d86a2f9c0b5742ae063b731175db54c5e3f7ca6bf3e6a68

SHA512
ea3dfc42368581f3dc27ce839ae548065b2273ab60144f9671c01ff02ce72eee4a2ea70ef28c61887bab7e28b4e7153715ea373ebe3293756323a7dd18bfebdd

Download Submit