2c31d880c2fd10fb74bfc4b40dd3401d8d0feb6ddcffe120ab39fa6f7d0098dd

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53e18bfb8f16b0818098632ba12f7a9d_JaffaCakes118.pdf
Size

75KB
MD5

53e18bfb8f16b0818098632ba12f7a9d
SHA1

19f8b50c53fb3f38dbfe8f02aa925d6486084aba
SHA256

2c31d880c2fd10fb74bfc4b40dd3401d8d0feb6ddcffe120ab39fa6f7d0098dd
SHA512

590144b486f9b3a3a7c1c5b59e9a46ad59fcfbc64fa2678857cfef68d351e6445e288488396069c49b88716a6c22d73e4e3fe71a93afe0ea723dc0ff7823885d
SSDEEP

1536:ZVfm8JX5cYsieXPEe/lkMVnONJf3WkNpOPu+W7WVBuEMI18cJm:68N5cJse/eGnOzYP1W29MICh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe
2416	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\53e18bfb8f16b0818098632ba12f7a9d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e21e301a3fa7c8d651f09611c72ed08d

SHA1
d866b0cae409018649e3d190b132cc64a318d8ec

SHA256
509f323caefddac7487818d963a631a6d0d9287728c94a711c156ff20e9f944d

SHA512
4cd1740f6fc97930161d47f12bd8d2401c8f2e04eecd82bb661bd41b70500f72d44e8aa42cb8aae3209fcafdbd40798f22ab84a50f16ff88f90093915b400314

Download Submit