656c7b0527dcdc9a8169dcdca617ac75b13166b34bfe0cd5208b3f3df9a0b800

Analysis

max time kernel
96s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45271ae19b806ff0c3abdd7ea5c58ac7_JaffaCakes118.pdf
Size

82KB
MD5

45271ae19b806ff0c3abdd7ea5c58ac7
SHA1

24b842452fbea04f690f1ebc91536a67848f7310
SHA256

656c7b0527dcdc9a8169dcdca617ac75b13166b34bfe0cd5208b3f3df9a0b800
SHA512

1fb6922aee928620b71946a3b6dd7ef6d51e59c6540d6b4be2453a64ee698fb6d7f787e1732dcf430213fdac1fa0e99a70671c854a844dd33c8c039937c6baf6
SSDEEP

1536:CvDkgU/UWNqSgLRKX+qRyqaWY2l8JRYtDLNcdzNKJZ4ynagXyU/hWQpOC3lRW4L9:oMxqSsRKX7XY2SuLNcdxQNJiUQC1LT3d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2304	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2304	AcroRd32.exe
2304	AcroRd32.exe
2304	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\45271ae19b806ff0c3abdd7ea5c58ac7_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f5fd57858c316ae28001207dee9ed4ff

SHA1
c38c403110f74c154af41002d9c12e4f880823df

SHA256
88c2c45fdd300fed82ca50a6a2b227f304d2c614472e98a82febd150c26e4082

SHA512
884ed9e740edf66e08ea1e5172f5df4b63fc5022c98789b289918b77f7ab198921148e9dff6e8f78c696bf57977fc7c8599c19b2f2838ffb93c73965bcc9fdea

Download Submit