2669accfd20a92d6c5f04b45569fba0dae4483d383241b8db9304b15b0afa960

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71ad5ca3f16287f23d6378890322e7d6_JaffaCakes118.pdf
Size

79KB
MD5

71ad5ca3f16287f23d6378890322e7d6
SHA1

94e889e94d163e728c26176c790dc86f123d4ed7
SHA256

2669accfd20a92d6c5f04b45569fba0dae4483d383241b8db9304b15b0afa960
SHA512

8f285f5f3e78a549d768a8e9ffee9a40740e178f05c31bb61bcfac5df14efdfaa3e061a7cd327ffba0454adc55e06db147a7c20ea8e07c5e484cd7ccebcc862b
SSDEEP

1536:8X9YM2mWyiTAlUCQyajHPGyBid/imsu+xlFVPWeQ914NCluzXWOpOZh6bk0:e05CQTjHPzBOimsfx9fQ9ktzQZh67

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1820	AcroRd32.exe
1820	AcroRd32.exe
1820	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\71ad5ca3f16287f23d6378890322e7d6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f1186bd3ec95fbe8e1294f2521000cf3

SHA1
0d640732a157773c7f17bc42715705cc6b355335

SHA256
20c9e9b4fd59d8e7ffc8f22e1afd3ec7c0b9848167c5c355e5242d0b98c0ce03

SHA512
86f46546964e834c24d1ec54973ac92192f1898ef965a36fb7727ef22b8bc0903d7599f4816dc010b64c4adbadfbb3d8030544d0216111fb2743989bf33c4aef

Download Submit