85ef4a4222e7db757ca9ea265a7a3b8876fe19fb28f6038ce68402b94e81c750

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30e78c8afe9fe11d2aa78d6e2bd2d706_JaffaCakes118.pdf
Size

95KB
MD5

30e78c8afe9fe11d2aa78d6e2bd2d706
SHA1

3ff3078e00a196187cea6b4735fa460479db2c43
SHA256

85ef4a4222e7db757ca9ea265a7a3b8876fe19fb28f6038ce68402b94e81c750
SHA512

3a7328fd3ca4adebb2c45aafbff081071688ed5426d5af6d0a8875abf359975c129d8a960a3d4ebe23f68fcc65bf67baeb23643f0c77f38c9ee063ead23528f6
SSDEEP

1536:+LLFwjd/7MclsQZfxLNiQKD5nHj7xSOCO2UCR/x/Qv9bnWypOlWWxCRNmZTSq16y:eLujpAclsQZFNiQq5nD7Lr2RtVQlclDt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	AcroRd32.exe
1716	AcroRd32.exe
1716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\30e78c8afe9fe11d2aa78d6e2bd2d706_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3b4ae4ca5ee55b5376814a25fcfd757f

SHA1
970d6f6075b76e126380966e01ab148d5ab5fb51

SHA256
96a308827ed0442ddc0d3b237d2a61820af2b51bee2d98e4d64c6724b7a7b8ac

SHA512
7b8a4427cbf6d2dd895c5dbe6756575e1c0d1c3165b41f71f75c7af6e7197da16d109f20513bf87e1b0cb8c9ba928ed549a816a26067d03220afbef8b38aaa1b

Download Submit