2062feaff89cd280bb8e6ae4828a37c1c2a78c4891d406d62fb7541683584caf

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

424cceae47c2c635bf43832429dedce4_JaffaCakes118.pdf
Size

84KB
MD5

424cceae47c2c635bf43832429dedce4
SHA1

704480b0bdc46274df32bb3c892f812c3b016b8a
SHA256

2062feaff89cd280bb8e6ae4828a37c1c2a78c4891d406d62fb7541683584caf
SHA512

47f3d48c8a0efc3ecb1c1a06ce7472946e6f614672b12476873b20094a3fca6917fbca1f7c36ffa9cac091a617ee6327a7533d7a8a7814ca21a0c8949f5b0063
SSDEEP

1536:PcCVANP01SK7UrHl75L2Sf9Cs8IckLmjnCpLW/wWOpOaZEWWBZdyumIxeZr:cNP0IQUrHfDf9h8fkyjCpLW/NaZKmIu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1352	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1352	AcroRd32.exe
1352	AcroRd32.exe
1352	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\424cceae47c2c635bf43832429dedce4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fdcd2d8dbadd6f7902d5f8459d0b4d13

SHA1
a265b5433aa41463813d6849f1c4bdd1b140161a

SHA256
0de55ed10aaa27ca23843ab47e112f2da0ad2a7c75d564f7c7d6f658e4df46e4

SHA512
a8fd0591841f9a09b91fbafc8ae1723344f16dc68d3bea155e0c990b3798491c8135cc47b0717fea221476dff87077164849ac1471ddfe593df180324b199af9

Download Submit