1d50b878fccd4476f89dd754f9981831265d9a2688c36a3793deedff52a4b5f0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4628ec5b83f8e7e71516e515c7c36bc3_JaffaCakes118.pdf
Size

72KB
MD5

4628ec5b83f8e7e71516e515c7c36bc3
SHA1

792a236fb95b51f63f3c2bb2adbd196ae00c0da4
SHA256

1d50b878fccd4476f89dd754f9981831265d9a2688c36a3793deedff52a4b5f0
SHA512

192f0d79def6acec8a69f8dad368949976feb6e6212ab4258595850d76ed3a2dc518eb0bbcd16b72e147d1bc084475672570d606860a1b1616c40230d3e43c24
SSDEEP

1536:Si3pBI57xcAn5ETQD3eIfNeql7/xy6qWtJy6WCSkSzCv+WspO2o8p:tsGjUD3eI5lLL9yiSGvN2t

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2560	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2560	AcroRd32.exe
2560	AcroRd32.exe
2560	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4628ec5b83f8e7e71516e515c7c36bc3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91651350e285252b5d93563511c11a28

SHA1
8ca948ace8325493080c79475635d83d7b9c8b14

SHA256
b8b0eb2b94f99767792b4715a48c5a783c146d778d5bb585e3a55d130714c212

SHA512
53dd1e949bfe05f971de84bfc0a6dfce7574671b60ba8c9b24b4cee699361bb0ed047caec20fba36c6d55e3b3dc20a5d99587a8d199a9a9e25251ed9451b166c

Download Submit