08237b5a0ce50356fc9975a6bb57504c1f802db47f2336989baf4f3bb28a2084

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54fd2f6c0209bf6f7948e1655cb7c608_JaffaCakes118.pdf
Size

92KB
MD5

54fd2f6c0209bf6f7948e1655cb7c608
SHA1

9540c3754d26d53c5ffcac5b44fcd2b47dcfe329
SHA256

08237b5a0ce50356fc9975a6bb57504c1f802db47f2336989baf4f3bb28a2084
SHA512

a07b5678f4de77970dc6a4371d45d8cbd1790b9f448c584483515c444e45ed6bb3d852f8ae999c9ac986483cc63cf4127bf888f12da44b5fed5f78bbe3657823
SSDEEP

1536:uSbwnU/xngp0M2rOj2CgM8TBjWqPgSdTybO3TAzsE7sWypOlWWxaXlXhLSIX0uEB:JwnUaj2CgM4WagSdTyq3TAYE7dlDavSp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1960	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1960	AcroRd32.exe
1960	AcroRd32.exe
1960	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\54fd2f6c0209bf6f7948e1655cb7c608_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
555390eae13ef02a2f32a1703926ef94

SHA1
5dc0bdcd87e599a6de75c34787fb4bb9cbd44ec5

SHA256
1bb6c442062c42367a303c6114232a251dcd373ccd77242857b592464418faa9

SHA512
c28beef556ba97ba861e980d561bd4587f135e4482ce943aad756d6afc110183009a65860230d5ca8995ba7615b3b6f1246cebfe53438a5125d0d6fb98b08dcb

Download Submit