2ad7e00cf9d5c28d2c1efe09e3d1702a54a3572811149f0da22856e0b14bbd2a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38ef5ca775a81c938658fbf63a5ec679_JaffaCakes118.pdf
Size

44KB
MD5

38ef5ca775a81c938658fbf63a5ec679
SHA1

dc4f5bba08a050477ed04b31d93f122f83c1437c
SHA256

2ad7e00cf9d5c28d2c1efe09e3d1702a54a3572811149f0da22856e0b14bbd2a
SHA512

f813e067f564ab1b096fd4138108ea67b2e2755d059c8c242088bf6d89997f82e5224ce9e15d011c2229e05ff9a8064a477b190aa2194c3c351b2bcf562d5e61
SSDEEP

768:MNAT0cXJVQUiOaALAji7gpMvfDpxpla7n2r3iczqt6P66zegcyVuf4VyD+E00DqP:M6geJaELAW7gpMvfDpxpla7n2r3izt6f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\38ef5ca775a81c938658fbf63a5ec679_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
77c47a5f627592841c86ad1be96552cf

SHA1
8de988765a01a464fb74a851377df15abb6dcdf2

SHA256
88eb76dd8853678ecbb7b89b387eb9612ada18f444a8ca42ca0a65a1ff4b94ae

SHA512
60c2021047bd28c0492d52b6f2877ca562af2f4f3d6f94560ab772a6af9aa69116da6b8cee0c76b9dd522bb9e5ea768df0cf0c69532202588ecfa217161604ef

Download Submit