4cf36b0b8d9d63408a7d548df0896daae40c88d13756633c617b6ca66a2ef135

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d79f07181c6a901a847ae8b038531e7a_JaffaCakes118.pdf
Size

78KB
MD5

d79f07181c6a901a847ae8b038531e7a
SHA1

457f05b95399782945ea62c6f66109de465509e2
SHA256

4cf36b0b8d9d63408a7d548df0896daae40c88d13756633c617b6ca66a2ef135
SHA512

e0391d7db5eb68379174ef897c1755e44b0228a9ce8c0664b50ccb21152659e584c9660d8913a8ba4f0745b1d51a89b4a0154d76ade4ff5221a0493fbe4ef84d
SSDEEP

1536:4bNw1Z8RPKlalSzRr44yTHrG66WawiWapOtQ3syyT8:GNw1Z8RPmakzRr4BDrXAw/tQ3syn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe
2556	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d79f07181c6a901a847ae8b038531e7a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cf5df01ec7ab671af1c9fd4002858c15

SHA1
50043ea8bedb2743bd15f3c05e922abb607ab1fd

SHA256
87fde34db780d22e9f4e947e5f4972363d894e5b6a38a0315563d7587b94f907

SHA512
d20133d483efd70f03835ca02d7d524f56bc29e0143aaa3eb24c3d22cbf3c4b960c2fe8dca0c76459b49dda53dc9c0a702f2c4d20a07db2a3e4b7222ec376894

Download Submit