c1d97b6d74c112230aa3b8506a00844e5028845300e9c4f29f367c55eef676d1

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d777ac4b39e67ea1d6c84d46e9367c0f_JaffaCakes118.pdf
Size

68KB
MD5

d777ac4b39e67ea1d6c84d46e9367c0f
SHA1

91ee862e1049cae589452948179d3fba79ddbf6b
SHA256

c1d97b6d74c112230aa3b8506a00844e5028845300e9c4f29f367c55eef676d1
SHA512

4088a832fa3573f58ae70c3c2b5cb961cfd38fc46e12d2176a89a12496dbba89e80be7a22613b9d806695d1256d3ba2d473c4dd7b9f507eb43e8e999f8b0e777
SSDEEP

1536:uqbpy4BdUK4vdz6YCiFiPgVla08n5bZzLeHUHA8RXz:DQKi7d0iigVQ1zLewA8N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3068	AcroRd32.exe
3068	AcroRd32.exe
3068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d777ac4b39e67ea1d6c84d46e9367c0f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ebf053009cf70ec46edec162081478d4

SHA1
622e980b2adbb98eb5fbee211ac1dae481980ba4

SHA256
788e25bbadd62b4cba24b0d8dfac5ad0fa89493601a3e5eae745a33e74879e4c

SHA512
41d410e937550089bba0f0e29e3208df15fe1802dea6ce1a7ef2435e7fe8d13e57006588fdf7dd34c62087bfe1f8989e19f15afddff6a848bab6e44a92ac99d4

Download Submit