dbe6c0025a050efac20f55410abff2db219cbf4c6f89625d6a1b35e5cdc50661

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4162e9a7bc51cb2482918117f294de84_JaffaCakes118.pdf
Size

87KB
MD5

4162e9a7bc51cb2482918117f294de84
SHA1

0106e9696c4f454b970932e4ea78ee6b150c6aa2
SHA256

dbe6c0025a050efac20f55410abff2db219cbf4c6f89625d6a1b35e5cdc50661
SHA512

4b24b35077e4cef2fa4b4442cea52b36ec9672991b26359b4a10795d66e803380cd2b429ab7d904b21249ba509351ad45e3b8f446ab4248fb8f80a0b763acf35
SSDEEP

1536:DIvTkWhIe7f6fKYBeeohP9uNt0WetFwu0arWxApOGUDA7rVhSG:GTkWhIe7f+KYBs1sNtSFoa03Geqrn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2036	AcroRd32.exe
2036	AcroRd32.exe
2036	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4162e9a7bc51cb2482918117f294de84_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
94f8e94b1951bf367ca0c1d015fde673

SHA1
614e524e542180106d847db7b1e5b66c181e913c

SHA256
a3dfc4a0e79a9dadf950e4faf98fa7d5d74c92e9234a152c877472e962bd803a

SHA512
232d9839c5515a84340c743c8e0fc08c8678f1a7b1050059391879b29301aba4ff4d068e32640138bf6a2f53f98e3989757db388bd2a95916f845da3b35c4fff

Download Submit