d5622e3f3151b30a47e3c78fb420569aa6c02e05e04e85715f717ffd8962169b

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f19e18928b5b69d6d2314ec2ea720c5_JaffaCakes118.pdf
Size

117KB
MD5

3f19e18928b5b69d6d2314ec2ea720c5
SHA1

ecb26d3bcce40fc7b6d4e2e51519a4ef4110d19c
SHA256

d5622e3f3151b30a47e3c78fb420569aa6c02e05e04e85715f717ffd8962169b
SHA512

4dbb94064f4aeb4bdda6d26cf1f45ef8bfc811f108fba470955127a49ded786a8235a44b6121fffd2fd64bef2e143e3db7d9f2d7b2e5bcf608f388a5ba74fdef
SSDEEP

3072:o7HYzUS9TjPpEuIoyzlhy6Xkw8xGMB3jpTa9Ccw:ocz79/xdAz/XXu3j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2116	AcroRd32.exe
2116	AcroRd32.exe
2116	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3f19e18928b5b69d6d2314ec2ea720c5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b39c814b397a6fba061dc972b20dcd10

SHA1
986da80703ee90ec21ec184ed42341123058f344

SHA256
3049810d388c5a7dfb92728ebe6c782d5d25dfc925ffebd3287015d52d2585d2

SHA512
fd919dbe9465eb75511ba03ff4218337445e706fdeb6290f132f459f62ce7f6c00784e2b13f40bdfbdc3388c8646b9bff765c4315ef95960d517730a8e8c7844

Download Submit