af27f34b0a12bb471a264359d13220142b2a782aae58a8de8bc1507a3a11ed0d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37d849f3c16c7f260f7caa12218ef204_JaffaCakes118.pdf
Size

74KB
MD5

37d849f3c16c7f260f7caa12218ef204
SHA1

bc1a637be8264503d52dfa2f9861a91440510f84
SHA256

af27f34b0a12bb471a264359d13220142b2a782aae58a8de8bc1507a3a11ed0d
SHA512

464247981eb6da750a7d68e3ca02f67109f57a01d0d4da64bb4963d0a60b668508bcef10b3a044afdc3edccbc35d316c0174fa24dc63b9adde263a5adfbc9136
SSDEEP

1536:UvTuYabOm7XGmQS4mPfoPADCV2+yAvs9kJDY3vrHsldddZJA:NYabd2G4IfmD/vyAD8v7sldddY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2956	AcroRd32.exe
2956	AcroRd32.exe
2956	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\37d849f3c16c7f260f7caa12218ef204_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0ce8015363911e1fa60e2b4f03a354ea

SHA1
83c0534f975a243efbe21e1dfe12bd7b62a7fa4c

SHA256
2757a25a1c533bd1fa291189eef9d2d7dd361d11fc76f4a73f63e078656d46ed

SHA512
a08694bc0646f9cbde6fe995ab23a5ba20ab3d65f55868c9d70b8e658871e6faf475daf1a9f37b87f1ce4f5a220da9d91453631cd20bf025aa42b3ce4a433f1f

Download Submit