0ddb4f5963f4c07e732433b9ad766e78e24bf7283f5e2a1c9a6e272ed45bf41c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a6c48d5d8126e428bb8a9bc19f2b6d0_JaffaCakes118.pdf
Size

61KB
MD5

3a6c48d5d8126e428bb8a9bc19f2b6d0
SHA1

ba060f42abf282b77ccfe9b4fd9eeba3741795d3
SHA256

0ddb4f5963f4c07e732433b9ad766e78e24bf7283f5e2a1c9a6e272ed45bf41c
SHA512

b2d22525175948d5c223839fe05a20d2a4eb92856eb8e1340e1ad6bd8609bb5ca76bec5f18ae0aef975b39e4625e29ac1f3056532512fd909ec52da90e259a78
SSDEEP

1536:Z974n8uYS4VHoBbu5DPOkZTABzpB73bNgocj1Ustj:z74n8zVHoS5vVOpB/Ngt2W

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1580	AcroRd32.exe
1580	AcroRd32.exe
1580	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3a6c48d5d8126e428bb8a9bc19f2b6d0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
16b70a7307243e4ab6df8f585b1462f7

SHA1
3267fa54cc630887dd1cc3ec5b0b5df417b96361

SHA256
f9cc75c99bbe9720f3911c80eb703eace142ac72129f282e2f6c3d449076eeb3

SHA512
8852d00d74b48b5a4f38aaefe26f1bc3c59ebcd35418dbd9e029237d701454a4f63d8f80d630c8860221b9a1ab8173ba433dd327fc7c12057bdc679204dd68b3

Download Submit