1402dd31b764b8947d25efeb36613a63bfaadf0a5b4ddad93bae512065cbe112

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

305e89395bba17ac01f24df2de93eaf6_JaffaCakes118.pdf
Size

42KB
MD5

305e89395bba17ac01f24df2de93eaf6
SHA1

16c0c9ff9b9b0382f886097c7aec075b20d8bc41
SHA256

1402dd31b764b8947d25efeb36613a63bfaadf0a5b4ddad93bae512065cbe112
SHA512

f239a1a7eb4bca85a08da151da96a9921bab2d9899ac8d39045620ed62fc9c0fa8d2bf88f33d4ad7d14adb3879608a249dae84d07e33c790c68023de74779153
SSDEEP

768:pbL3Ng8N4DDhFLAi7oiANoqvqg7IkyyTnsGanK:pbL3stAi7otRqg7VyusPnK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1608	AcroRd32.exe
1608	AcroRd32.exe
1608	AcroRd32.exe
1608	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\305e89395bba17ac01f24df2de93eaf6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9883e40a7de31137bc91a6ef2debc838

SHA1
5d3bf8294e02a26f9858ed05c706fa7481dd6aae

SHA256
68fbefb74bff30d71bade987390d0db8e1a36caeffda5e924c2cb5963c39a332

SHA512
b65e20eee71decaeb2cdcd152f1501f4b97d0f56378fa3d02dbe8b057498d7a58bd4d7fbb4c8e4fa9196505ca24a6616e7a66072fd4c79c101ef285b3ecd8ffb

Download Submit