b699679b7e3dacddf2e5ca0f1f902f828d19eb9d71d79fac489d92a50096a0f2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3099469ec1cd5711651820a1364b226f_JaffaCakes118.pdf
Size

74KB
MD5

3099469ec1cd5711651820a1364b226f
SHA1

ca00805f2cf34a3472ac3a41be4f5746053d8170
SHA256

b699679b7e3dacddf2e5ca0f1f902f828d19eb9d71d79fac489d92a50096a0f2
SHA512

15062072b7129ded7d70eadc80e1e0b14f88c6dd1bb2594fd4d2a696ec58d4c5b81c385d9edf7fe6b85bd37022c032dcac6c2743650dde62959648713a25f549
SSDEEP

1536:4ihO942LGqvkYTz/2ym++RGgUwlZ/dNpHwMqzd7BWYgKec/0yesB2WtzfTZM:phOW2LD5P2ym+lg/VHGd7BWaecMyesBi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1928	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1928	AcroRd32.exe
1928	AcroRd32.exe
1928	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3099469ec1cd5711651820a1364b226f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2c0af611e7ccb0593e067bc26a8b5818

SHA1
2627ba5bda3dc10a6e7bf8018b4aadf8232153cb

SHA256
fea7204a29cd2fea4e6ea4257c0cc4c0f4bcb47376e28eeeade2cbdfbb923764

SHA512
508c6bbca7a5793c1f299c4edb450868bc49310480578a46f0d50e648333dd00b2c5c5a10b6791499aae46fd9253f5fec62e03a25cc1cbb451c7343d73b95361

Download Submit