d3393df0253aee387caa244353d9b15e155eae3125b1f8d4a7bdad98eacdbbb9

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43a2f70787e1cc9f6ff0bec3d001cd40_JaffaCakes118.pdf
Size

70KB
MD5

43a2f70787e1cc9f6ff0bec3d001cd40
SHA1

c198f8ea0a0bde216fb38c020b3f5db99444c54f
SHA256

d3393df0253aee387caa244353d9b15e155eae3125b1f8d4a7bdad98eacdbbb9
SHA512

d322d0fdc7611eaa6170bbc44cf8fbd2f88168ee858a185abcbfb1edd3113c25d9bff015f8d360718f2d6a550110253438465dbe786145065d89532812d77d75
SSDEEP

1536:BGrV3eHCQ/8me1qBB6B7VVX4FDtCWCpOViIWX2hYkrdJjy7:grYi/mwqBMBnXm5ViiYQJW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
392	AcroRd32.exe
392	AcroRd32.exe
392	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\43a2f70787e1cc9f6ff0bec3d001cd40_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
60c05de901c3bc15fa0257e79e0790f4

SHA1
bd34c1beca713ac342d7335fcce4b44567006c68

SHA256
8434c54b9b0de24e5888f9b7b3f60bb3a287de2e15b9707269fdd61e7b3107cc

SHA512
5e47b831f2e3d61caccbb5822f818f09a76d9dde84025cf57698f6b2a6346e202dc3b2450474f3fb91ec88ae315b920194636de2d045046e81aa908b8f7c3a2a

Download Submit