c7455f3b876e29e77e11ce760aa5188208a7125e193c1111d2e8e69a86f81f13

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ca400a54314bdf6af23c361095099b8_JaffaCakes118.pdf
Size

71KB
MD5

3ca400a54314bdf6af23c361095099b8
SHA1

166b6108bf0c6818c98a04dad802d0e6f22d19d5
SHA256

c7455f3b876e29e77e11ce760aa5188208a7125e193c1111d2e8e69a86f81f13
SHA512

61d940ede8d4a5ffd5844c838570fafa2754ebdcb2c533730fb0c27ba8ef3772987dbebdca5ee87b0b78b0501302cd9a8bf0d76d1e47dfa91066a0cabfb99cb5
SSDEEP

1536:owMQxv1CUhJy3VfbexWgYmvbggGClDgTk3jcHaJo:bXyFjeMgYpVClDB3jcHT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2280	AcroRd32.exe
2280	AcroRd32.exe
2280	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3ca400a54314bdf6af23c361095099b8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
83c53f8298d3e9e5f5eca09033c0c390

SHA1
12c0f5d1d0a6a8bad1669400440939bb3d17db40

SHA256
d06cf4579cfe2117e11df33a3f1237dcdce6bfdb486caafe069a86d7f5053fa6

SHA512
b37adc8c61d448fba603c6353fc60957bb194b58d727dd5cb1de3e349ce2623764586e2c3dccc4d6572904576d395b5bf6deadce21b720db195e060e54ab279f

Download Submit