465b0377907ae0385dec399d25bbf443c935028a8a87355c00dbe10388af0578

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43ad17bfffcd725fee767f50e521c220_JaffaCakes118.pdf
Size

95KB
MD5

43ad17bfffcd725fee767f50e521c220
SHA1

ab503536d1b8bf02f296a6aaf861edbec2dd867c
SHA256

465b0377907ae0385dec399d25bbf443c935028a8a87355c00dbe10388af0578
SHA512

20664ff93475777da61a378bba2a0ddc2bd1463c33a4e9d92faeb4c05f3355621ed46675b7abf475e67b86a2412683d7da059a374170b8118a3dd3f191d428b0
SSDEEP

1536:VVHAC0itvfxXyzvh/G6KxH5v8ikS2z58PqDsqE37zWVBypDm0NqNWepOyt7g:cC0kByDh/Ghd5vMS2z5SzqErtsWyS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2316	AcroRd32.exe
2316	AcroRd32.exe
2316	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\43ad17bfffcd725fee767f50e521c220_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
19e3808ae62a58af203d92b5ecef67b8

SHA1
65c1e9c892e89fb6a1e707080e809b0d6f74cedd

SHA256
b1aedc14f1266669ec9fa9fbbbbd71848d246663c327e6eeba815f1b311445c1

SHA512
8ac39ece7e5cf169b33e52ea45f216092be084e63acdbf6fd0c2825862988abaaf799d5dc4782333fc89656b9aeebabf257c5d8a0664234b50e4b2b597fb983d

Download Submit