504f8addd04b65066fdb0e39fc09068f562778c97e2e42cbd0fb26a55c7b5d78

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38ee793354a3bbfa37c8a4866dfb9ba0_JaffaCakes118.pdf
Size

75KB
MD5

38ee793354a3bbfa37c8a4866dfb9ba0
SHA1

c16ae3d8cccfd8f20450a22a42f83ffc828d6643
SHA256

504f8addd04b65066fdb0e39fc09068f562778c97e2e42cbd0fb26a55c7b5d78
SHA512

a49767ea837cf4f66ea41f0b693d9d9ca4c11c40fa30cb4c11c6020f622f8daf0b5a9993ad10c8e9cf09627070e5e7cd6c4dca4b600e872215591add0c61cfd3
SSDEEP

1536:2PoqR3Si1hO+gjjGzLkbXjlqiObx90D5fu+ISm+Xedq3q2ToTVXmzkTPhF:TqochO+CgLIXjQtbxXX9q3q2Ykkb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2748	AcroRd32.exe
2748	AcroRd32.exe
2748	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\38ee793354a3bbfa37c8a4866dfb9ba0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6df66817750f0fabf1e49b06671f4634

SHA1
6e63b57c0c5801ae75efcf10bf0596d6be38f1dc

SHA256
7739ae46ad47490623a5d8f98e744e78aa4823dfdf9afee0665f7564641ee6d9

SHA512
52026fe5f308cd3a8fb85994da69c99ae282016d02ef1c22bba9632bdc79d0908623c4168a9a177077ecb63e916922edf2777c6aaeeeca00a8ad7157672cf3bb

Download Submit