c1ccb8fef8fe7db7e9412708d4f9c153fee1c6ce35881d6e420561ebf7238f04

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54f849a5b4ce1975f73fd063d5a3c84c_JaffaCakes118.pdf
Size

100KB
MD5

54f849a5b4ce1975f73fd063d5a3c84c
SHA1

8ae8cee48c5600b3e118c4795d00b43d34f530c6
SHA256

c1ccb8fef8fe7db7e9412708d4f9c153fee1c6ce35881d6e420561ebf7238f04
SHA512

6eddb5047c0176a251ccad9aa8330db8ba04cd2b6e8569cf276e2aa8c5f406132f526456613cd93942f0596d098e985d4214bbb8f44f6d7fde40d311aebe2eb0
SSDEEP

3072:L6fd4C1FX4v/H7fSFq59Ob90hXLWb2ifBiTu2vwkvjQtU60:L6f9Fo32w598gaTJinw8j0s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2248	AcroRd32.exe
2248	AcroRd32.exe
2248	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\54f849a5b4ce1975f73fd063d5a3c84c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4849b05ab161cc389c2188d3d228c9a9

SHA1
1eb6d12026ba8588c43c5c0bc2a5c2734f7b41b3

SHA256
ef3063bd5702912a083ab0e99a0f68216e69e9136eb574dd634fb0469166a869

SHA512
4f1eb9dfd8a3de5c3f60cb8c4c86a71be4cb77f1ba91502d8a7a8f1d027b4c50cb9dd524fccc2de2a5bcb555e16fefde8ffef5269a4cc55b38ea1304f721b406

Download Submit