1fca2acaba8960f93dce3672863658faa02ad66b7f7b5fa82be5777375be74c9

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55677ac2800a9755c1a8a419fa58d18a_JaffaCakes118.pdf
Size

91KB
MD5

55677ac2800a9755c1a8a419fa58d18a
SHA1

a86cd32be7eae45dec87f3ee2e696c14bde0c9df
SHA256

1fca2acaba8960f93dce3672863658faa02ad66b7f7b5fa82be5777375be74c9
SHA512

25f735dd403efe57302b2bc935229494eb380fd6fc0b4949b31e4c0383e568b781de4ae75e440b8769c930add4d38b1f6637dcd667b86a01c8fad2b81e107ef1
SSDEEP

1536:wC/s+0E6W/rwrK+QwPnvkmlQlGKZyY0sTWpvGb7+x8pEfUWmRoW8pO+vpE:N1frwrOunvkmlQlGKZz0sSGbbEfU1T+2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2220	AcroRd32.exe
2220	AcroRd32.exe
2220	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\55677ac2800a9755c1a8a419fa58d18a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1e946ba9a6324401caf293db6c109ea3

SHA1
00db2e7b558e6cffe1b02d04e427f20a2fd43503

SHA256
74f754e78b55f1d039f7749cdc5e9b77a039759f900e6014e2fb3452fe681f21

SHA512
fa4ec023a03bb9dc5c430131a2a240cb3fd13cfd17c282c9582540d4cfb1938e847aa5d9a8c591e26c643be69e4970a125e4765d0d2fbd1f996f9d966a276134

Download Submit