f554dc987a5be9433804f5f832ea46ec96f897c7339b36ea40110665396828bd

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3df7d7146645abe46e0338e17fb51b39_JaffaCakes118.pdf
Size

85KB
MD5

3df7d7146645abe46e0338e17fb51b39
SHA1

f16e3ea27d19d4bbd2616f16571c178bb1a9e18c
SHA256

f554dc987a5be9433804f5f832ea46ec96f897c7339b36ea40110665396828bd
SHA512

9c4355d191e2a597ebea7b5faa1f25a014f7772f1f33b64953a6f7247af0617d656e871b5f5f3402febac0b5b6ea9d159fa35d7fc66976c19f163f8e48caf36b
SSDEEP

1536:CWfp3Q9TdntGxbCi7FfODoX6UZWyqfFe7R8BPkwaNy2WLBWiYehWUpO7WbH:RhA9Zn84MMDoLMyqfTPrL9BbYek7w

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1868	AcroRd32.exe
1868	AcroRd32.exe
1868	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3df7d7146645abe46e0338e17fb51b39_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91df7f8f9f1b329aaacb8b273f5c71c2

SHA1
55d8be626baa57effb185998eb151c3012fe2f90

SHA256
ef5dc5d60fc184116ef55d6d75a0d18fe2564ef1e4253ed50bc65e31d96b5e8b

SHA512
5fb75644ab3d6c21834c61ef8e1bd2f327016665f2e11a41879ca0b6574c2ad25895dcb561dc4b92ea0c1fea411f99fd27654cf6d440079382ba485759b6be9c

Download Submit