28c7a85e6776b65581b766c504528b586b9560d9eee441cf84f09adba9118743

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f4a2fe233a728dbba9755586db6916_JaffaCakes118.pdf
Size

79KB
MD5

b4f4a2fe233a728dbba9755586db6916
SHA1

b21d86c7e8f943ad78cad1b1b6df756a8864b738
SHA256

28c7a85e6776b65581b766c504528b586b9560d9eee441cf84f09adba9118743
SHA512

0ed467e8d2bdb974e2e78acd14cd07d38ab5885a36af5c4f1a5ac234b70f85dfe4b7d318a0a8fc506a7c70a8d86b025987c96c43f390f26e82cb88e4c74104ef
SSDEEP

1536:OVnUul/RCAgP9NyyvFqTSX8fZeKDIhyny06fZ0Q2m7OdjDD3f:HNVokcWXuZHDIgyF8m7Mv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3068	AcroRd32.exe
3068	AcroRd32.exe
3068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b4f4a2fe233a728dbba9755586db6916_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
65b62013a2a7e01d66283586a7a9a7f1

SHA1
2180869f5da1976a897a163ecdf50c6c82bdd13a

SHA256
84287a87c281f2688aa4bd0a9a26d2560fa74432d92a550dcebba0c820389044

SHA512
565c0cf0c21a685907b518cea5f9fd1c3952e7763a51eb463d606698b9a316b7455f58dc16ee773ab223cfca317e48e0f76061aee2ef1745565ee3e3000706e2

Download Submit