c4633759d8d37707270d9c356fbf6191f61fed8b68872bc3dc3bb2e019267c1d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

686be6c5508ad42719b142dea475e271_JaffaCakes118.pdf
Size

83KB
MD5

686be6c5508ad42719b142dea475e271
SHA1

aa216f70625f41dab7bd61fc1ad152cfba98287a
SHA256

c4633759d8d37707270d9c356fbf6191f61fed8b68872bc3dc3bb2e019267c1d
SHA512

a66661942861f3ae5c176f53972dfd78f3a628b4026e15d3de0096de0d739320db700afb473f060ab5e81a0fe118ac165bb959f6203f036a02539021be7cf2a2
SSDEEP

1536:XG1PnkptDba9DjECet995AgIl1MQan93OBWapOtQsSnk6+WSETG1gp:W1PnkHDbw4Cetn5+MQan9XtQsUJrCQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1544	AcroRd32.exe
1544	AcroRd32.exe
1544	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\686be6c5508ad42719b142dea475e271_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3e08b362a107e1c7cb8f86a18f012d77

SHA1
d5b15b1ef32a8960f6acd07897d0591051133b6c

SHA256
c92f4d8af261197378d1656821607db0cbfe5d40da165cfefff51dce4a7f5ba5

SHA512
abda7f85f5894d12bce0d7080acf13e9dbe97394d9c7d6782eaa64f30a9ea7671eb93b2ef4be547a608e49a0a09e4b6470c8596015f1c9a7a545fb455ec9bec8

Download Submit