435aa65993479cc821e239cca9cc36767150c0b230f30af876fb84013d446844

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4eaea0b3185b028c9cee3c0d500bd07_JaffaCakes118.pdf
Size

79KB
MD5

b4eaea0b3185b028c9cee3c0d500bd07
SHA1

dcd5047298d450ecefb13cf164e9c1d587f18274
SHA256

435aa65993479cc821e239cca9cc36767150c0b230f30af876fb84013d446844
SHA512

b727bb5abde4897aa9435cc6dd9ef80b867772bbb27df6c938e29a3c2417a1ab075c9e17b9f56c4e2bf5108c2a3e1048548bf94fd9f4935291a5c926e7227138
SSDEEP

1536:V5qlsBxRYIwjjQkSeZMRX8HF3DhaHaz7qaatRwS8mmk0dnRrFEuC:KE5/eSRMHF3Dmafqvt6nhdnRrFQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	AcroRd32.exe
1736	AcroRd32.exe
1736	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b4eaea0b3185b028c9cee3c0d500bd07_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d17fe7b6da60d08939cf40092ccdb0bf

SHA1
776bed6a249006cc7d9302d7736c79b0791e3199

SHA256
bf54cefc58cd9179af07bb8604daaee506cc4e910e6e1ccacb8c58fa545ec6a2

SHA512
5b80946743b8abea1203137e92402a1b74054ca68f0038289783f93083ee0a69bb1adfc414b9913a2700cf9337f362d97541316e47e750393a87174602dc5882

Download Submit