4a09ac92bc06f637f24abb09107d81dd27f3d4e76785d31d7671a9b54a971186

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 04:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45f1073dcd5a315a6eb7af6c4c5ef7f4_JaffaCakes118.pdf
Size

72KB
MD5

45f1073dcd5a315a6eb7af6c4c5ef7f4
SHA1

d09b15064b5b4c268f95b29b4dde7abc79901782
SHA256

4a09ac92bc06f637f24abb09107d81dd27f3d4e76785d31d7671a9b54a971186
SHA512

6779b937a9ca60b84c6b4db58d74ca30f3ffe4aa11d9c12a4a98a4d9f38ef650777d358162e2f97c766c5b9b2310617654196280e65a7024b185c0861e0439f7
SSDEEP

1536:xomEkD3+YycVMH3oZbLu5EtkWIQnMjxWGpOGoWpY6SRe8rrW:dEkFYkPu6tlKGG3SR1ra

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
304	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
304	AcroRd32.exe
304	AcroRd32.exe
304	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\45f1073dcd5a315a6eb7af6c4c5ef7f4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
78d9fa31df5e90ede83be6fcc95fe191

SHA1
d32d045f30efab58a74876e2daf070a3ea46dfe3

SHA256
cb45107f3ee0336f0e0d7d45ecad0604d03299be94c4d59eed1d6dea86b81b07

SHA512
b875c4dafa8ae6e0c60f73b4bf5235f6abfea9d864f8a999d7d115ba2152641b7f4dd03b1e8b13fb542e65a56d67077a026edbf8c8d6516fe8d9de4d2ab6def4

Download Submit