35d3aa9f95e361a577ce1a0a2bae414991e743f7aa859af0a472b75a7af000e5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7836d42afec16f4d0be7acfcf1b1b32_JaffaCakes118.pdf
Size

94KB
MD5

d7836d42afec16f4d0be7acfcf1b1b32
SHA1

75f9c199e488445e7ff5cfabfdcea1ab225b3f12
SHA256

35d3aa9f95e361a577ce1a0a2bae414991e743f7aa859af0a472b75a7af000e5
SHA512

c830706626a4a8f11403a2d106e92cbc974fb0a67306eb7d0d3e8e909890855f1483777c43d6b9f6a5632b9ef6d6668293328d8b8c4bc1215621834f8d12ff43
SSDEEP

1536:9W/b0tffbu3qI5NGg4QO/GJGYCAEXj2sYGg0TD5Y0Ij08EWiWQpOCoW3t+dwJj6x:20on5Ag4R1YCAEXKsYEBrl5WFCnt+da8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe
2664	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d7836d42afec16f4d0be7acfcf1b1b32_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a20be59b14298ef9a436d46d52d73525

SHA1
bc9edc762cd15d8751404849c35040201d8e9c9a

SHA256
172b2c53202ded6bda5df9e2235f1f0e138c012d3301635685a01674060fd43d

SHA512
34cc9943fe855112b18807d418b8f717e7d2cd3dadd1b3cc3794aeb8d37ae58a755ab6105353d354242454d71defbb16d53d1cac9c42ad6c3575f1a4bfb4ad2f

Download Submit