4ac66af2d202b1751da16f52d7fb405acc28c020063ba3049c165577a4dfef39

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d79deb34c46b5dc3d067fd8dcfde2d40_JaffaCakes118.pdf
Size

91KB
MD5

d79deb34c46b5dc3d067fd8dcfde2d40
SHA1

a83b84f8458c005f52474d31290a3b0f7e047554
SHA256

4ac66af2d202b1751da16f52d7fb405acc28c020063ba3049c165577a4dfef39
SHA512

d6a1ec72c24744340cc52eff111ade29af1eb36988f6c97932c42520e8d9dffa27b96e731fb0e21fa7f85d6ca29499750fe8d4770d47c61264937b79257307fd
SSDEEP

1536:gBe3Sl8ncrp3LDlWskgDJiMkwqUTKDWd/XYg/Sh/XQjWmpOSLWUxqESaHC:E8SGncrpbJ9kgDJloUuDWpF6h/XQcS4d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d79deb34c46b5dc3d067fd8dcfde2d40_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5a13d64470f308206eba6816e98d88bb

SHA1
90eae3237bb6a97c15b6cb16af205ab1ad61b48a

SHA256
dcc6adfaeeef478bdd9482c114d5f9cbd24e377e8e2597711cd5a4afd841de59

SHA512
e8c8e988849ce4c0c3977dd6c881db91f115674cb5edb4a5cbe497b20e33ab68a02c4b6f4d3d8c5114018b5480109e2a9cb1b78a4ad64cd1420ac8030640557f

Download Submit