c3aef25ea2879de2778b943c07c3c58887fa89137775cc4f7eb0b93a27660aa7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40d68eea70b971286a7f34ee9ab17c79_JaffaCakes118.pdf
Size

77KB
MD5

40d68eea70b971286a7f34ee9ab17c79
SHA1

cba6626f775a1ddd214abdb3ecd00e7973ecb153
SHA256

c3aef25ea2879de2778b943c07c3c58887fa89137775cc4f7eb0b93a27660aa7
SHA512

fa4e0b09518a692220b8a2815ca20a2eb4fab8fd3650fc6d33647a40fabdfb7ac80676fb77cf501ad8e3e67835442dd5b45ea5d0af01baed6210b1763c05a04d
SSDEEP

1536:Jruigk3w3E8Ww4++IsjyKCN38e85cWkNpOPaWGBlBtHP33kuKoD:gigkqEVh9U3P85RPwTtHPEk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\40d68eea70b971286a7f34ee9ab17c79_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5fa7a6acada98ac00dcefa30cf06abf5

SHA1
efd5edab4dc581b49bfde533a40e13bd012b7a66

SHA256
a331b31ed52f12429819a787e6fe788285a067f2c70433dc2f0ad676b7c75cf5

SHA512
7b8076b8b56f4f8462538b43471a1f0c08e92d8b7a4f7613d236dabf1435dfd2ce118f67673daf489b0b826f2296e19b2cb7c66d84d3e6c3e412010bb86dffe5

Download Submit