b1494f55e6cbf1eda4d8a4c96f5bd3c4e4411be3682bebd6c7fa7bd0671eb611

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4599695a32090246df1d7da91531091a_JaffaCakes118.pdf
Size

86KB
MD5

4599695a32090246df1d7da91531091a
SHA1

4e364dc6b75a64ecce420171c595fe612f4bf698
SHA256

b1494f55e6cbf1eda4d8a4c96f5bd3c4e4411be3682bebd6c7fa7bd0671eb611
SHA512

d37db0cd0c40af8589f56a103543cdf3903a9233f9962f2fed4e2320d6ad1700ae0f2268349142390765acf5c43f7afcc98539f3e9dc7582370057f63b0c4963
SSDEEP

1536:/dT6c0UEyX/+8fNvKCzmmcqIDKKBfabFSo8MWxFvy60WOpOaZuJUhvXVgLSv:1Tj00aCzmmqK0o8dFRaZsUhvl3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4599695a32090246df1d7da91531091a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6a2c1455f1b93ea5f1f9cb3a9927d469

SHA1
b99621cf71e123b13c9622f75d37757f4cc00ccd

SHA256
7acf2f30b5709748dc7cf2fb39134b6fb87b4172f19228821c78005420937155

SHA512
f207e72506d076a679128a6a0623c9f467a81b16e84530c82a2e0c579d90a65df22777aa6bcfa0dc27d650803a568455bbccdc1f35b6365dde9bb09ee91119c2

Download Submit