5721ae19031beabcbe538bbd781495e6e96f6c5e7c96bf7901792e8a2badc2f5

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f56a99e9864a1122cf25cc65ac6ca3_JaffaCakes118.pdf
Size

89KB
MD5

b4f56a99e9864a1122cf25cc65ac6ca3
SHA1

20fdb5ccadc4981f49370f5dfda8b9cd10f60119
SHA256

5721ae19031beabcbe538bbd781495e6e96f6c5e7c96bf7901792e8a2badc2f5
SHA512

894b1d06043c74df71865ffa08c4c249975648445d5340e28a19bab3c16f1560542f85023ffce50cc4261b3c334db6760385a3b37a3a09225892dde8726ee9e9
SSDEEP

1536:tnrbqcGmdIorZnikV6un3K8WgGlSKfx+y9PW7QPWABwWl29Hqlzr7jWOpOZdwbF:dqIrr9iijn3KdbsydeABb2Rqlz8Z+F

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
540	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
540	AcroRd32.exe
540	AcroRd32.exe
540	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b4f56a99e9864a1122cf25cc65ac6ca3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
053669e39dcb755ee988215301856490

SHA1
47f8144c0d35ba1ae14bdc30d2e05faf44b7760a

SHA256
5566faf572b1c25727909683706a747e0dd878b72ad392011e3ee71d28c73148

SHA512
51a641b211d178da1910bdde03c5fc1a523ca1dab46f704ac9d4a86206f7a762dbaca2b39cc2b189ebd7d5136351546c840e776d50ae833d028e1bae17b843d6

Download Submit