85feaa7efa4f68123eacd548e0eaad40911a02189c025865916222f606c42935

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

380d86498405408e510c995daa99473e_JaffaCakes118.pdf
Size

86KB
MD5

380d86498405408e510c995daa99473e
SHA1

5efc717510618351e17221adfa31c368aa75c45b
SHA256

85feaa7efa4f68123eacd548e0eaad40911a02189c025865916222f606c42935
SHA512

4747f6902bfd0cce3ec09835e3b28ebe47442c04b2880b192f382a2eda41ad091128baaeb4199903a91d47ce4aaf06784d59f6b2e5ac96d6f03517cad9e4b8bd
SSDEEP

1536:AYyxwcGCXMJr67g8jAuF7UjJ1C0pqm1Z4HDlKWr1sbvR40r3aluyA8LWQpOCGbw:YDhX6r67DjtyjJVHqDllubu02lpA82C9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2996	AcroRd32.exe
2996	AcroRd32.exe
2996	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\380d86498405408e510c995daa99473e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
15f5f5c247f3b120dab0beacdddf1072

SHA1
bc0c30e753019e84a1126910d3f549b3c6bb176e

SHA256
c41b94ab9ad73d9078de275e0f644a77ac50dbd1cb62d647d79151dbfe98e2a3

SHA512
2cef512cad0337c34f6f1d5ebf9ab5b365fef106b27933f1b89accf973ecaee46e18a0d8c3f65c5fcc20f21247b9d75ed75016dfbad58a30eab6371aa5a07d50

Download Submit