f196b37ea1e351d3a2ae83990d1395373ebe4249d80697481e7ea0e821f4437d

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44592d209c8b4fde1d5ab66019789de4_JaffaCakes118.pdf
Size

82KB
MD5

44592d209c8b4fde1d5ab66019789de4
SHA1

199c59c360ca36065f08d30ce59b370c5b9d032a
SHA256

f196b37ea1e351d3a2ae83990d1395373ebe4249d80697481e7ea0e821f4437d
SHA512

4291f9ce4e3144d40598b18e823389265eeb7587947c8c07075cc6fcdb627045c913abf627b583d576b8183c31ef867a17e9965c5a133cb870baded86844e15e
SSDEEP

1536:snHPOV78WLWyMTbmyHLe1XFTSKphpdv2n2JDX6WOpOaZUfQgSZWE2VFvU/xb:oH4AwWykbRLSVWKphpdvpDaZCXSocd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2896	AcroRd32.exe
2896	AcroRd32.exe
2896	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\44592d209c8b4fde1d5ab66019789de4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
07c0578871b7c17700b9e21cf5c20c0a

SHA1
1b398ca57ece663e46146a0056fc10ff98d786f4

SHA256
2ac35dcc770dbe5328fe9d4974ba5cf4b07d0ceac2e85a918bf69f58da4c68c5

SHA512
881291826b937f38c43f212f1a0ffdf918390784acad2226c13270fe611c040b139519bb6b81f9ae5fd9ded449b91db9a21fda4278b8939caba4686975cef536

Download Submit