a2047f79c52c53ac2ba7d38ad7bb8357b64ca4f725a02b3052081a3eeb82f9a3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55ed53d15784571b2be6d4695030c2d3_JaffaCakes118.pdf
Size

93KB
MD5

55ed53d15784571b2be6d4695030c2d3
SHA1

b001a038d05e956e74cbfcd28367e3072ca5c8c4
SHA256

a2047f79c52c53ac2ba7d38ad7bb8357b64ca4f725a02b3052081a3eeb82f9a3
SHA512

dc4c0459c3a22d3720b4590702e60c5efa3207234f7b1aa861755261cc3408599707752d9eb73bf65f70ec6b83b884776990b9db5002d72d860884acc5de0544
SSDEEP

1536:YQvgvno4wCF85H+7kJngqrg6tW1A4Xtd5rMZoWpxLSXOoz4zE4kGedrlRK:Lvyo4fF85eWZ06tWu4koGFlu4zXnedr2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe
2852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\55ed53d15784571b2be6d4695030c2d3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
adb296a0cbc38e9252d3ee49c02fb95e

SHA1
0b3a00b3a465644ec8e1d093245ba8583cd38eb7

SHA256
0df7e544d16dcb147efd8458af777b8a02d0fc51a9d2c70531b348f4c94a0681

SHA512
e2d89c55d121b730ba1c192d205e25bee23b1c9c4ff67499450682c44e69fa629646a850257a2032403b51a285358c7cf16b317de23c24b20a5593557dc12919

Download Submit