48446c5642cd34f6cc5d36a11a1d9eb5ffef04d99116df5d527131975d7fd8b6

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416ec94ac3dd0068b1edaa97b430e0dc_JaffaCakes118.pdf
Size

153KB
MD5

416ec94ac3dd0068b1edaa97b430e0dc
SHA1

f2eeee23941e7ccb71c23347a14629bcefd7cec8
SHA256

48446c5642cd34f6cc5d36a11a1d9eb5ffef04d99116df5d527131975d7fd8b6
SHA512

8f387ec5876c8273c8a2ad09c5d48bf85d7aa14a76c4dfb0301eabf9773e37087f98e028f5a2f181da339fb3c2151bcd453045b7ef2bacb6b6fa981ef6116b09
SSDEEP

3072:DGZ1O6OIfZWJjaOirIcD5sgzaxaOG+21FxIbaAz+rC1qW1YRb9Y6n:gMIfZWpajMxG+218bLCrCs5X

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	AcroRd32.exe
1736	AcroRd32.exe
1736	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\416ec94ac3dd0068b1edaa97b430e0dc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2ead560ba210b82f2923eef656cc9fcf

SHA1
6da08295c6348ce680b8db6d631d57b195c2b8a0

SHA256
0b62a8b94559fdaefe7ef542cf6fc33c1aaabcf24a7ef05fd6925d07ce3751ba

SHA512
ea7a3717e903f7a4a682385062b32bef89b0676c8e464696c90e570e1be1e6640514f9f20b5b1d61691086867da002115fc71e11a993e2bcbd3c72a9ce47ce81

Download Submit