c3e56fbc88e6f63102a047b8f063d8b426cefe5153aa1526dd02c404ca6441ba

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52891d844c7a984c2a2014a5473b7b68_JaffaCakes118.pdf
Size

86KB
MD5

52891d844c7a984c2a2014a5473b7b68
SHA1

57bc8f9f84bc4a21fb7f29092401ca0efc807390
SHA256

c3e56fbc88e6f63102a047b8f063d8b426cefe5153aa1526dd02c404ca6441ba
SHA512

bc65bb531b476fb69924b4040441e9e96a08ff71942098ee4e717989911e1e25d352704bbcffdaf09cb25c80e37e0d8d3c29537ba4476ba8de1165beb46f202c
SSDEEP

1536:q6w0YvEq6Zlw9Lmrbt1/H8YuTHipOR199ZDU9xevkOGiLFk9oWapOtQHWT6GB5T/:Dw5+w9ar5BHbuTCO/9TDI0Gkk9RtQbGB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1744	AcroRd32.exe
1744	AcroRd32.exe
1744	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\52891d844c7a984c2a2014a5473b7b68_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b39385540430de694530ca53aaa119b8

SHA1
1067cef908c58ac4544370bf5b0d77acee7855da

SHA256
191cfcc0bcc8ee42c8e570857673ee317d8e453ed0af3114949bd7e569f12be1

SHA512
506fccd67ca488703ee25a4686e999d3f9d055e33133c455910cda3d0645fe085a9a120a24cd6f6df7cbabc26d2d1c3d8ad667f32f9f6ac7ce9ef9c7799299d0

Download Submit