092fa922156e5410eceece0a39aa054484e1e2409bc19b6d8c5494fe7eb23077

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/10/2024, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8276ca73518a52add4b4f888bd3093de_JaffaCakes118.pdf
Size

82KB
MD5

8276ca73518a52add4b4f888bd3093de
SHA1

e49c06aef626db6eed5bffc4455287f44b5eaaca
SHA256

092fa922156e5410eceece0a39aa054484e1e2409bc19b6d8c5494fe7eb23077
SHA512

610cdea3de3b53cb542957a0387091932aef0e0bcbcfc2361af606b923dcef05aa75f3bf0695ce0928c2cc557679198d49230d3cbaccd5bead6ade7c74390548
SSDEEP

1536:THNjXvxJqbo0ohgYrnT1IYpMgQo+Sh/99RoJrVlWspORGWYeBwgIikrL:DN/0ygYrJIYJQo+YRCVsRipjD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2424	AcroRd32.exe
2424	AcroRd32.exe
2424	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8276ca73518a52add4b4f888bd3093de_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e1e63c71ce3ac20530188798bae3b0c9

SHA1
3840ec90dd13be6b2e084757e6ed31c729107e0e

SHA256
02e559d45b02d5150a9212f706b37b56a7f486cb6c03a3630266d0ba1020dc39

SHA512
8f18ad29270fd462a4fb8e6e9846051a66bec412d191dd7ed37e43644192cc0ba30810b03a4a78d6f55f64cf8a1a1a71468715a3b264e0b9cdb2e097f436c012

Download Submit