1d4e495da20c9051ee187aed1545be09e2f171d5bcbe2785f1f1cc982896bf03

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d774bd6c3ad14d90414b831d550df7f1_JaffaCakes118.pdf
Size

69KB
MD5

d774bd6c3ad14d90414b831d550df7f1
SHA1

5c3ce3b380e8e7b799b062df19e2d45a99883368
SHA256

1d4e495da20c9051ee187aed1545be09e2f171d5bcbe2785f1f1cc982896bf03
SHA512

dfdf013efba2602837ef8300d8d16e83cb7281b888269a5a821732c0d9206f56f7276cc64573213472d5d5e33ccfd3f15a0886a1ee5a00ab050e99f863a171d1
SSDEEP

1536:EIDUeEWjySJ6PfBcKdW5FJ1pKroAxNUwO3r:qFMyM6Ry51pGVxuwA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1488	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1488	AcroRd32.exe
1488	AcroRd32.exe
1488	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d774bd6c3ad14d90414b831d550df7f1_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
40c1b73f73945317c9c9ce3a400b84c9

SHA1
50244d3679d684ec1e0b4815822f86d4c0cd5b41

SHA256
6ed5b592581db04277197f074b1828085a688036d05db32901d2b22bd2eeedf7

SHA512
d90bca498b970afe2d2db901554c90c65256e7147ce644fbde710b4543f04d1ac1f17d8e839b3c85c214dd40aef79f568e6b97d56d920357893c792eb76a9e02

Download Submit