a1498c7d8e9f0e69267850f4559895919c949ed0380db054caf5f9ebd576a104

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f1d0c95fea76bc9e8fe083034c4c765_JaffaCakes118.pdf
Size

77KB
MD5

3f1d0c95fea76bc9e8fe083034c4c765
SHA1

cddf2f75fcc60cd29c52be45a2274b095ba1ef47
SHA256

a1498c7d8e9f0e69267850f4559895919c949ed0380db054caf5f9ebd576a104
SHA512

e1ed39e5d08bd959c13f74f0caf2dbc86c2d30dc3fa20e9dcef488384d938dc42fea4d986808d99c7a29a30b009041faff718fb6bbad0b11279fc20f091b82ea
SSDEEP

1536:06g2PeIv3u+C8oov6nToShXcM24mm/BoO1pV9ewy/w1JpqWl4NGGH75FPoz0O:LvGIv+nZaShXX24JNml4wH77PE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2116	AcroRd32.exe
2116	AcroRd32.exe
2116	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3f1d0c95fea76bc9e8fe083034c4c765_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
49c2d65d6ee92cc08146f6e7e33bc92a

SHA1
7a1604910c66a26f8f305678c6f4cc5c9238cb93

SHA256
671c6a916f518ce023ad41afc2d32e5e0f718df5d198a9509d5faa2ed83549df

SHA512
b684de7b2300c5d3663c992f820c6473df9321bc2061f4297872e1d2b2f5201a661aa2f14d8a67d11a6fa9f84cb055f324d5229af22f680377ccf294a2b7b7f6

Download Submit