36c8fcb6be30b169c7929aea7157c22d84d8a6685b122a8f8172ce490724d329

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4231262e72ac2ce9715df4f2c7c6ead2_JaffaCakes118.pdf
Size

70KB
MD5

4231262e72ac2ce9715df4f2c7c6ead2
SHA1

da52790ba85e27d2375d9b5761ae176ac1273c6a
SHA256

36c8fcb6be30b169c7929aea7157c22d84d8a6685b122a8f8172ce490724d329
SHA512

26bdb84cebff8ebae1c75cbd72ff89f4373b9ff66d899d6d902ffe9cb115d6721d3017b5eb3c06f6619961b516c4f055cc404f60b39c5d4e2fbe3ec01c0b9494
SSDEEP

1536:/MnRkKEI8q3S//Or/TR9LbeBlfzr7OdrTYiebw5cEut:CJbq/Gbd9Lba7fiek5Ct

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2544	AcroRd32.exe
2544	AcroRd32.exe
2544	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4231262e72ac2ce9715df4f2c7c6ead2_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
86a890b78c50978e37c54d6fc394af04

SHA1
d92447018721af43856f9c1893c9a27a325cea61

SHA256
6b05eb4fd61cf6ed145209ea33aff819903334a1f9a29371d88a2086e9e69e0d

SHA512
1ff5207da0f7da6e7ef84e5bc0fc15aba848bda27dbc592ae764cccbd55b0902cd4a01e674233d5c007f7080113b74b802f85a079904324cd52cace6c18f812d

Download Submit