db1fa747914e1387cb5389dca76eafb83121b00905d9fe3fedcb672750442665

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7881b9410fe0b9eb1aec847d783477f_JaffaCakes118.pdf
Size

80KB
MD5

d7881b9410fe0b9eb1aec847d783477f
SHA1

b7c5a96b27d111f21555d2237569759d03ade802
SHA256

db1fa747914e1387cb5389dca76eafb83121b00905d9fe3fedcb672750442665
SHA512

ac0d9ef1ee73e49bc810746bf482f3c01fd5d4cf219446d13dd999bf45568aded62ad85d88e818c5cfab36859db92b91266fa1da3a05ea347a5daaf5cd95e545
SSDEEP

1536:NJwd6WxMuyhjP7KhsIz+8jlmG4Bn5ZjlBi6aWYF/u9XNFWspO2DtDh:XI16PBomjB5Zjlk6H9s2v

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe
2684	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d7881b9410fe0b9eb1aec847d783477f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
72d6d41cc91d03111ad7fda96561b6c3

SHA1
e3c3a1fefb148fa63ec017a09d716cb3a0377e94

SHA256
ad372b664dda55970e4c52ea162e13ee88ef7b12689b175dd11be523befdffd5

SHA512
31e6e5d3b090de1544b827076c5eaab444ec2af565d84495647f8dd38940a7f075b4c9c5f63de4cc6bac8cbbf87c3d6a788f07eb9a7fa61af3ea11ac79426d91

Download Submit