141f7ab72a92d3efc627ac8d3789317161141cf0e3effff8ce73147408516ce6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

689ceca283f92949f4eb9346e343888e_JaffaCakes118.pdf
Size

81KB
MD5

689ceca283f92949f4eb9346e343888e
SHA1

723021d4d3653d36b8ba8984bc0dd2cae8483383
SHA256

141f7ab72a92d3efc627ac8d3789317161141cf0e3effff8ce73147408516ce6
SHA512

627a1d186286ac1399a461d62a932339cf8673a33261aeeb31901e1719d326f162228dfa682b24f8d43b5321ce0ca18385c594d729814b415f868eb02b381357
SSDEEP

1536:+mO3QBeB7EoWRrnuA/Am9b3mtHGJ1W6pOu26WkJSVbRmO7VLcT5Hs:ZOAAB7dWhuA/Am9zYzu2CwXFhLcT6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2060	AcroRd32.exe
2060	AcroRd32.exe
2060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\689ceca283f92949f4eb9346e343888e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
15c7f2ebf217ccd619c8c6aa6aa382d0

SHA1
e05412474532a6afe6743f5b3f850decd9afd6ec

SHA256
185a75a8f03f47b7cea962e82aa6d27aec8197c5acae0fa313af43604333917c

SHA512
841df7d1d72c25ca0035f2575de45cebbf2870b91c8e7903ac7e280692f1a3eeec8cfa26013b4a8da2201b707f28b8a7dcf9bf50356699d5eef123b18d1c319c

Download Submit