713c2149391f1f860d21a0ed6e92c7d9392cb9b55ad80bfe2245383df897e841

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a2167a3ea7ec20a2b2e05c593a7e9cd_JaffaCakes118.pdf
Size

88KB
MD5

3a2167a3ea7ec20a2b2e05c593a7e9cd
SHA1

fc5c04be7285bdbafb9a149c40bb985c5ff04457
SHA256

713c2149391f1f860d21a0ed6e92c7d9392cb9b55ad80bfe2245383df897e841
SHA512

a9c7ca88a0c30c4d49dc2610ac1f9040c95d8073cdf86f2e51805f97aa14eaf5ada812235f735cc6e6e3b2456bb1c93ba78be638f827a25812bfa5f11fb8a881
SSDEEP

1536:WQUtWsP3DigDUdm/jRUu6a2KQcMuyn4oTUOTPQrIGcRWSKtvHMLW69B5+W6pOu2e:7sPDigDum/t6RcMuyVd4gqvH8T9B57u1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe
2644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3a2167a3ea7ec20a2b2e05c593a7e9cd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
71e3851c49c9c12f0db7b67a9be3dfef

SHA1
4f104345a4e60968b96b222e8fabb4e7fd3d565c

SHA256
77d502cb49becdfe5a03b504a67f8085e4a4c8b6b09794a2e1692cd5e65f37fb

SHA512
299f1860ce07f294daa42391828e18d84ea21931e3038fc15dc01b21586e341b0880bd3260c634cb88e12d47e9e11e9f8115f66bedf0fe4568fe4b03587ce563

Download Submit