4b87baac7b0a95591c8bfe34584823ecc40f13af6e8f9b6e7380fb1c6d7164ad

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

395dc577f3e41b8b66efebfe0364c3e8_JaffaCakes118.pdf
Size

94KB
MD5

395dc577f3e41b8b66efebfe0364c3e8
SHA1

3529ec5333cfc6114ce480c092a2645973abeaf2
SHA256

4b87baac7b0a95591c8bfe34584823ecc40f13af6e8f9b6e7380fb1c6d7164ad
SHA512

84b06085c476e46af3c4280e36f70ff4daa3f81ed6cfcb0757c8bd620df2fe1a73ad0cfaa11da6c8601c0de6cab66ec75be79119872d6681d695d9d451a18685
SSDEEP

1536:b+j8r08Fv4apYtRVE/L7ltHTkCiNWyKRARgltGzPMAtmzV918BVSErd:ax4A6CRWPlFHi/Kizmzi/h

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1636	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1636	AcroRd32.exe
1636	AcroRd32.exe
1636	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\395dc577f3e41b8b66efebfe0364c3e8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b8ff948d9c1fbfebe74bdd6d014683e5

SHA1
75ad548d3ee8e0d680b0a2853bdb483b78e7e8bd

SHA256
9b1b2c9b6d12d11a904c94f8b0fec589c872dcd66367a490120f2f3e3bf0d4ce

SHA512
24586257bb0485af2c37686152db6ca6af5bd75ed3db06b4999931dff681faf8b65660b8f5f2bd02e96e2c4b4e37452f6710eb6d945e680c9bdead2a509a9076

Download Submit