c2edbb24b46513cf800096215ae4826a1ab12e764da32fe0db68306ddb19d33f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7846b8032aff5f52feab966464a34a9_JaffaCakes118.pdf
Size

82KB
MD5

d7846b8032aff5f52feab966464a34a9
SHA1

91e4eacb1a78ba190a28c1caf357056166fda90a
SHA256

c2edbb24b46513cf800096215ae4826a1ab12e764da32fe0db68306ddb19d33f
SHA512

0c322425b7854b80984f6345365e5eeb58127e7203ff71d1a80bdda8bdfd3b920a354f7f14ac5467e85367b39038ec0cbad8f445aad3703578f1c6757e004643
SSDEEP

1536:KtVPErJcmuEdrv0toeXAD0W6pOu28cSWAuyfXzVLl:SErJcmJdT0toestu2TGfXn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3016	AcroRd32.exe
3016	AcroRd32.exe
3016	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d7846b8032aff5f52feab966464a34a9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d4b97b1158990c9d794fb25cef6e1f2

SHA1
017aa6fbb55e32b1b57a0443a307ab9de0acd8df

SHA256
04e93c5a8733669ccf20ad6150304867a4f1f9898f4b8a60d54f71dd2ba82daf

SHA512
910b2df5f0435f8e7f8266a58a7840d56fb3b472dd7c32c10091da8e7c8fde1671e755bad3a2a1fad3c18de2287a7830cb059f32a237346b45c0b3a28959a511

Download Submit