c2450c3273b1abe01ddeb048b5a628d73ee4679276d94b477e6bd9fbe276d4d4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

555e737aad084bde727d74ac97da5a9f_JaffaCakes118.pdf
Size

86KB
MD5

555e737aad084bde727d74ac97da5a9f
SHA1

a8deba117c5e0cc58dd8d7ba057362f6ad4d79da
SHA256

c2450c3273b1abe01ddeb048b5a628d73ee4679276d94b477e6bd9fbe276d4d4
SHA512

c0bb60d9bac49605e5db412386b94402c0114175163304628d5ce77b2eaac76b9eb900ef996dcb45bc0603a8883323d3aa6552b5367353a3a05aa6c5b4812b9c
SSDEEP

1536:B2v1AeeF391QAw0ZAwmTqFrsKDHX43R5TOlD7RjVyWG0mjoWGpOGDh7julyN:g1APbQAwPasAoB5TOlRRI0C9GV7jB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1684	AcroRd32.exe
1684	AcroRd32.exe
1684	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\555e737aad084bde727d74ac97da5a9f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7310e2b5250ec55c6831fe254e1c808e

SHA1
23fcca20e3d6b556bb7461f51e2082f50fb71c96

SHA256
dce2d0aa29337a68eaad6ec14f3e193c016277500855ce331045ea3a337bc380

SHA512
eb3048b8d23b4f30b53829c8a4d56abb3b774f85e0895570b8104274ad75856e9ccca3b9b2128c44e1d5d47c30f0f782e0b42d8f8bf4acf1f082ff568568cb6f

Download Submit