876a109869b38eac4827e18e552b20840f53f365e3513b7a4b48d5c8ce7cc6dc

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb548c44cbc70b7499735ef2ef54e0f_JaffaCakes118.pdf
Size

69KB
MD5

3bb548c44cbc70b7499735ef2ef54e0f
SHA1

a7a786ba9d75e5cee1387d27f3f76f53a6c4b521
SHA256

876a109869b38eac4827e18e552b20840f53f365e3513b7a4b48d5c8ce7cc6dc
SHA512

7987df12f942b4a83ceb516fef97e9ef9a2f0baf5728e8547396e75caa5eae4cd59e472f69752c9c63860b79f73e8ad1587ff89ad755ac12f59b248ff8c233b6
SSDEEP

1536:i8RX0WOTrTly09sbi8zjgIJEDk/DW/lJHkmr874k0DPu/s4:52By09IpznJ8k/khrw74k0DPu//

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3bb548c44cbc70b7499735ef2ef54e0f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d43573d6e58ef43e5ad5f1727b2a9ee6

SHA1
1a18462499694354200b878bba0941345f80d114

SHA256
e0367c90456ba167be1150323ea7faef4a0988ef9a8b638e3f2191be061c764b

SHA512
665441d2ccf77196a300ee470a7137463abe114fa5710943e2cc17b8c2166576820a49980d9bc57c1a274fda840f05ea18186c6137a3f0e778004bd62b130bac

Download Submit