20f6c923edb7aa4185626ba53ade37a078c6ea0279eb294cbd723585ca2c03ba

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d791723f26873c5eb67020ded14e4b69_JaffaCakes118.pdf
Size

75KB
MD5

d791723f26873c5eb67020ded14e4b69
SHA1

497ca18905e202b27f89f82bf6740574331512c1
SHA256

20f6c923edb7aa4185626ba53ade37a078c6ea0279eb294cbd723585ca2c03ba
SHA512

dab0c1f517069e60f4482ba8bfe485f83de958aba140a9b311f1be4a7eeb5102aa6483fbbbda68ec4e0f89fed8d265c34eb39f20a62e4e7930b3767377fe53ba
SSDEEP

1536:6vkBHma94dKl9b65KzFAzmyz5pwjYvv7DIzYJU8/yW6pOu26WXQaTFPhya:e9cOKl9MK5ACydJzDIP8/fu2ZQM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d791723f26873c5eb67020ded14e4b69_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
961aa12a9923abff4f8c0a3fea9b4828

SHA1
a3099504703631e75c3473ee7878486093a838ea

SHA256
9a362aa19068868740f14b0d18570506bdce5362873171c2650322b98ab58ca7

SHA512
417712c78d26a400e34a8855bd671eaf90bb47a57e66136b30e6c25009937a985fdda025d2978e684bb92623c8d3fdf68432ffbfa53e1e53e7251bced1559cb7

Download Submit