518115f4bb7673c2062bd7308bb6f40de5971cda7972f56154742a1f838e6211

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d79f86cbd826b004dd7bd9aa9b4aa254_JaffaCakes118.pdf
Size

78KB
MD5

d79f86cbd826b004dd7bd9aa9b4aa254
SHA1

beee3f2e8597cd0ca54cc8f207e51d7fc533dbcf
SHA256

518115f4bb7673c2062bd7308bb6f40de5971cda7972f56154742a1f838e6211
SHA512

f02a9a0fcdfb61d120d9f3afef076aa8650f0f2d17d4a6578b2b18123831f2b5fce02a2a54498cc32f9628f8f7bb78ce81f0d459b73301fea521d1b15153ee7d
SSDEEP

1536:j5P9vt8/V6KsPyJYhZL74Jttcbe+5aJ1bh0KcVqcmlyKRci:l92sKWR74JtH+5C11TojmkKH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe
2888	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d79f86cbd826b004dd7bd9aa9b4aa254_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
da7d73bd89ab38b6fe368cfa58c96cf4

SHA1
c9db372487c1849930e9ab4a220098de42301e6c

SHA256
9510555eab17a216f861e82a75f187afa07b7e2d2c00b2de1cbd8c611a5cdb01

SHA512
fad5497bdfd7f2e7cddcc0f202eda74da18ff42ab30649aa78250c53bd9f2174d2bf10affcbfe260ce55d6baddc5319066e42f51bb126bdb9699808007e3e516

Download Submit