61b0e8cdd1f1b2bf17ce162c61e2f7031ae84c2cf9ede44cb0e0f28e60d6d16d

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

548fb0e00a7a74519098d02e9eb16d8d_JaffaCakes118.pdf
Size

86KB
MD5

548fb0e00a7a74519098d02e9eb16d8d
SHA1

2064be58437a9e8fa580799c0dabed18e109106b
SHA256

61b0e8cdd1f1b2bf17ce162c61e2f7031ae84c2cf9ede44cb0e0f28e60d6d16d
SHA512

09c3570d3b71bd3aa67e583c01fb7276070a271652d80ab132d33fff964e5e0d189933638bc52718188b672953c1c1948cda30d1bc628af03c2ae38dd77e3817
SSDEEP

1536:r9oCT014lwZFJ7UK7gSN7jN47yLKSKpYGjYRXzqd37q+WypOlLVrbWameDkqz4qQ:ZlT014KTm0gSNV8SKpLYIZ7q/lLRzlQj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\548fb0e00a7a74519098d02e9eb16d8d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
10e546b90cc57ba70c5ee302ab7d5f69

SHA1
ce0ad223044e57be4afe5d9db3fce4fe140845b8

SHA256
5b811254dfec7901630fad2aa98c53af06e8e35df029d90aeac20d10fb44c9d1

SHA512
3d87c3daaf2e83f48afa00f131c7aeb1d84027c92775c5fbcce8858993cc907cb0930e562523c9b5024612154af0087fa2423507af6f359eb63872a024f20af9

Download Submit