cbb001ef813257eb4f500a9dbf325e1b1ab858b2dd1fc3cb69fff94a0c81827d

Analysis

max time kernel
95s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6892483da7c429d8b396f1c364e08958_JaffaCakes118.pdf
Size

81KB
MD5

6892483da7c429d8b396f1c364e08958
SHA1

a7eaa9c6ccec48980ec8b85ec93589ca0f8e7729
SHA256

cbb001ef813257eb4f500a9dbf325e1b1ab858b2dd1fc3cb69fff94a0c81827d
SHA512

237f3ffb0f833c8bea2464c4ff4da17b7b9373cd16bdc93d20bda3d8dd1887ee570a63e88fcaa2f7f32749805adadae68388cdf8b27a8fa44cfd4b9765f95f94
SSDEEP

1536:ks1mFPlqcSCr+6iIn8Aipy4hgUiTB2HTWvJzX3FkTW8pO7yCX:SyCS88Aipy4J+E4k+7l

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2468	AcroRd32.exe
2468	AcroRd32.exe
2468	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6892483da7c429d8b396f1c364e08958_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2706e69f10e5cb254d1dde6fb6d9ea4a

SHA1
e7ff41baa73ab71bba247c60535a1ea5df54b06f

SHA256
b42c9d5e934c0fba33427a3917b4c7c58b47d758c360eb68d7a3a5ebdabf67bc

SHA512
ef48ba45bf9df35c1520324eb261a7c717f6ff28a06484fcb8642656b061ff2728d18c40341780d73da0dbc6883d214cdc1f7b6dcc345bd13880ab0504d8d388

Download Submit