355d52db66b6dc054ba0a0bb979dbaa96bf98fbc16468711a86b5f8e344d71ae

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44c312f86c2dbc4a5df0b4bbb7290eac_JaffaCakes118.pdf
Size

74KB
MD5

44c312f86c2dbc4a5df0b4bbb7290eac
SHA1

93fbc831736dc55142b5a0eb8487098632d070d9
SHA256

355d52db66b6dc054ba0a0bb979dbaa96bf98fbc16468711a86b5f8e344d71ae
SHA512

ffd2dfdf5520db53dc16e04db0bab48c58b03db4a46bc271f42659f7d53160ead6fa53c849f66ef72307ce03a613ce599b60511f444a1b4ac16da06f16e7e908
SSDEEP

1536:5MLYeqXhkMT6Au1Zcfntwar9Kr2XIoSbDbmMD7rLgptE:+LnmkMTkSwahKrMqWMfngk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2792	AcroRd32.exe
2792	AcroRd32.exe
2792	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\44c312f86c2dbc4a5df0b4bbb7290eac_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
260c00e84b5ba851ad13884b99af7329

SHA1
d2ef127a1803866e3197decd53fed508089a1c71

SHA256
c3762b172d6a2dbeac483abdd381fdfbfe9f0a6b7033248d2403052b118dc992

SHA512
6fca1b9ebdec629b27fa0b030f8c1606b00c6df4992b5f3cfcadb5383f6ee7713dfcab8aaaa125fe445ff0254e85c3fcfe9742b5d7ba25d80d3f36f3c7be1014

Download Submit