63ef102b9adfcb29c8035fed2d3b57016fb77b92483d9522fe2c55ba36bf5887

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39bfa12c41ec5f3571f22f85522b9607_JaffaCakes118.pdf
Size

89KB
MD5

39bfa12c41ec5f3571f22f85522b9607
SHA1

c20fc07639ee85bea5873b00cfa231142791cc4f
SHA256

63ef102b9adfcb29c8035fed2d3b57016fb77b92483d9522fe2c55ba36bf5887
SHA512

a4bbe0a2eee0a1360efd715786802aa25455b0c8c0e2c1484482d0ce79fae2d7a360dc799a6e2cf46bd495dd988d1d63b0e82a02c6d757c677b60d8c8fda09ae
SSDEEP

1536:dykQmhOxDlmQqfMrx6DBolPBF/cIt94xIC072QY3yFhjwu0IBuc/h6AFxLerZGXR:OoOOfMl6dybcwKxW2jCFVwiuc/RFQZZC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\39bfa12c41ec5f3571f22f85522b9607_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
132bd818f0311af71a10c1afbf1844d9

SHA1
c6153fd38f16d67ee17ec54a295ecc18ace64483

SHA256
50f0c1ac6c835ecc6024c3728b3a1ed16c953f0c0b9c3119066a7874995f8829

SHA512
f40e0c9e875b6c949874161bdf69bfa6dfca086a3ed197536369d11dd40dfcf41ca51848a69abbe657f8a953b0e97ebf5f154edc28bd0da2525b6f95b9b9cadf

Download Submit