b604c492e3a8f48df458ae09a189f31580c4b446255af5b3892ac9186508b902

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d17b821b3735182285788ab7e05e45a_JaffaCakes118.pdf
Size

73KB
MD5

3d17b821b3735182285788ab7e05e45a
SHA1

c0b44aad7084e874d70c92d6cd77433956074bed
SHA256

b604c492e3a8f48df458ae09a189f31580c4b446255af5b3892ac9186508b902
SHA512

ec7a523baa4a5edcc4e267f85b25f3a333b3f32308f80a75c3dae7906dd249891f4ef254b7052f6ef9a0241880291b3d07c6cb36cd860acb6e5714807d238175
SSDEEP

1536:W5m/NI/pqNOoG8P/W2W/eDK9+MmNmU6/WOpOwrjK0IWD0igU619S5:EmKpGY8HjPXNmh8wrjtIig54

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2528	AcroRd32.exe
2528	AcroRd32.exe
2528	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3d17b821b3735182285788ab7e05e45a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a73ac56a9f9c2120793cd700f2b91deb

SHA1
56537821f72c80edcccf0192188311b12477a897

SHA256
e081ecd9a4ec98c942f74924318eff9ab32328ce18e584f5f65670cae30a5589

SHA512
92d3227a9185e238881c037ccf5704482464297b0303ebc9807e0771a9a32dd76f55b7d8d3f54f04da14110c392ffe21d1e1b11b73595fb861c37ffc0f3f571e

Download Submit