4dbc3c671b29fce7970b76bd75109ce88347f09c87446579a38e0c602a57d4da

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2edefed6294c42a2129aca99af521926_JaffaCakes118.pdf
Size

79KB
MD5

2edefed6294c42a2129aca99af521926
SHA1

8f7cef58abaf1142192dd94097f61421782c6c21
SHA256

4dbc3c671b29fce7970b76bd75109ce88347f09c87446579a38e0c602a57d4da
SHA512

10e04ccf21fc691aea0ba48152c73f0af823260cb6b1b99938d99195b50e71e5325d21c0a77c7b8404c431436c05953308d832767f32e6d72da8cc61ca4cdfdd
SSDEEP

1536:3lu5vl8p15XBrf9DJe8yr0bBINjUqgpJmzSJ4a+IkCwp7bWVpVcParP7xrUbWWAv:w5vlOZDryr0bBIGqgHk4+IkCtpV4aD77

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2edefed6294c42a2129aca99af521926_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
66141514b230d5b1d0f3e61d468c4e85

SHA1
8689b7485830ca720d81942a1ea0c8eb1ff268b4

SHA256
58e32445f45f792600623d3bfe5fbb06db21c2aa7bb325b53f1a55315e7aa4d9

SHA512
41bdd55a947030dc623ec23c1b15a7b739cd5c8cb01ebe96f30c805ac99edd618b11d8fac7953e4099c99641108ae92d600dcfade6e1db8d485a258428587e95

Download Submit