fea164e0d28aeae423811dc84b9fdfe33f96c6472b48b83d9d7756b444265c11

Analysis

max time kernel
93s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

382681420741b07edf94ea8adccb6cd7_JaffaCakes118.pdf
Size

54KB
MD5

382681420741b07edf94ea8adccb6cd7
SHA1

1412bb50a0a75466acf07d971fad210b7d680c07
SHA256

fea164e0d28aeae423811dc84b9fdfe33f96c6472b48b83d9d7756b444265c11
SHA512

c826eb41253a570ab9f55a7a753ac9898027a94d902cd101cd5294c00728d92580ddd59e9dd3a82780496be6941bff59c872fc721df51800841c30222c766ab1
SSDEEP

1536:0fc1qFbzw/jz5XLZhdvrmAy9AeZOWe/jZD0:D1qRw/P5bZh9rmAy9s10

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\382681420741b07edf94ea8adccb6cd7_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ac0a0de967e16d5f584d322d41f3f8c6

SHA1
46246e32228f9fd88a68483271dec2643b849b75

SHA256
51b0116be6c861a077bac3636ec0b1a1a991af412808e400943ee30f0409cd3b

SHA512
c20f1b8a7e5cf43e9af88addc89ca6419f2083d6d0ddf35b850f3387bed42d61751a2ae43de01c70a9d70d8c2791ce3364828a721b4db731ae8ec36310e778c3

Download Submit