dbdabecc2b5ea7a2d8be4bfc421360e806a8339b007fdf9a445a81937e2ccd50

Analysis

max time kernel
95s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40a5bfa2d459855e04e7c2508ca7c410_JaffaCakes118.pdf
Size

96KB
MD5

40a5bfa2d459855e04e7c2508ca7c410
SHA1

0228e5d722059bceda1b37ddd867f577f9d67347
SHA256

dbdabecc2b5ea7a2d8be4bfc421360e806a8339b007fdf9a445a81937e2ccd50
SHA512

a58e3a713d1e6d5ff7e8e025d6f64d32318803d5811bd430c4c0a2cc3378143e5500de40eac4962bb129598add9341d63889dd3280e7c0df80ca5090ea5321d6
SSDEEP

3072:+n2se29i3gJkxodEannEzReCd+A/F+fg06:+2se2UyEzMont1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\40a5bfa2d459855e04e7c2508ca7c410_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bbee8dd5f9ddcf9684a9e887cabca1e5

SHA1
97b40df5c31dab47148e959b6e7e158da3c42ed0

SHA256
9203a894f2d563d4cee63ac504e228dedae5c8a93c9a25c4ed478edffa49aa02

SHA512
98f903f284312864d6b89893880753527ac3c4fc5984e4e333cb6bbea418f7f59736320dd7657f85af8e73a395cb3f4b5e605af8dbdac61850c31b20c5f9df52

Download Submit