ba8b3b6625bd2dbc647a86b91b164b9f80817c4ea6d43ce7814996509df32020

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d645b548f2c909eec6f021c97bd3346_JaffaCakes118.pdf
Size

91KB
MD5

3d645b548f2c909eec6f021c97bd3346
SHA1

c4d5b80c4388cff1cbbdd9d498eb0e39dbee901a
SHA256

ba8b3b6625bd2dbc647a86b91b164b9f80817c4ea6d43ce7814996509df32020
SHA512

3926b1cf5f05b0832c22daf0ff53c8b5739aa7c10a58e43a1c94b6fb6780ec15ec667475616b9b515ad6dada158bfcfb2469ae79fb7f26b53a0c07c9bf276efb
SSDEEP

1536:cfO1TkbxVysNlT4X4E1NdIZQK0b6H4rGu52EiuIZGlv5dc7nARAVRJATd84:gO14isNlTU5D93K4rGu5AuFvbWARMqT1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2444	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2444	AcroRd32.exe
2444	AcroRd32.exe
2444	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3d645b548f2c909eec6f021c97bd3346_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0abbfd2dddfd6a74acc47becf926a6e1

SHA1
773c5194ecad37f27b4fb7a2b24e16d1f6155a26

SHA256
ba7cd6cfcc71ea14215cc6bc4c00fd285f001418d4289924e07cf99c3afa683d

SHA512
f16c6710ad2ae47ff459ab5578d34898d1c0eb53b95e2045a129a7db69be1ab6abd34a00048988080cdcbbe76874c72a129e96146750f5361c301497f2b73e6e

Download Submit