ae3a225e03ec3a342f3f6397033443195ce48b83c6dca151e89db39eaad2d4d3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45849e8a9764dcf16c9e68e672fb3ffa_JaffaCakes118.pdf
Size

75KB
MD5

45849e8a9764dcf16c9e68e672fb3ffa
SHA1

99fd19fa79cf8fbe4d0097e5ae84e20d700944a1
SHA256

ae3a225e03ec3a342f3f6397033443195ce48b83c6dca151e89db39eaad2d4d3
SHA512

7ab63ec1961841fb0d7f8660e08ce475116a5314d9d471c1750a8f9adcfe578d7fa9677d79a822383f089ba01259a48399401eb81a07970516686d317f7a25e3
SSDEEP

1536:c/RJ+bzjLjM5oyCcQ2f9GZpDiED0reOfgau5GOquTWcpOm9Wb6qQQjjK:cRJ+br4aJr7iED0Hu5RquymV7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\45849e8a9764dcf16c9e68e672fb3ffa_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
708cb47c24c678aa8194f083d5148aee

SHA1
bd0e11e5a64942b66dbe8b24f9bc164ce028c067

SHA256
b6956c78ffdfa955ddbbc69632f93076c29b8fd5e8f7f9ce2ae6bf25fc3d405c

SHA512
5985055989067a560fd3b3648618e2828854d776b9a80b9bf0d7e240df5b6cbf2a68e4d52a0e1e9fbe3579215a5ba91cf071e4b5c9ba6926ce281969fe54a357

Download Submit