0c2580e6496e16492fcc828646d924f8e3e23575f71c17036fcc332e42d6d835

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

709ae328b3aa434fe666e95b762e7dee_JaffaCakes118.pdf
Size

78KB
MD5

709ae328b3aa434fe666e95b762e7dee
SHA1

fe24f32a4d07b9d32c1f0ed1a636456cb758b5c9
SHA256

0c2580e6496e16492fcc828646d924f8e3e23575f71c17036fcc332e42d6d835
SHA512

e46c38590cdb4b638e7a08c4a270ce3baf79e87b8d3962fc55100f7b4294da99d634132422cf2ec9ef112da3024cc9c31097ee615da0543be8c9ed1c99315a85
SSDEEP

1536:XHDSCMCPA4Ya8gwhIfFYIu6o0yEan1zSXlXlov4QJKWc4c4K3LWspO2kt/:XDSCVpb8gwjIup0yL1zSXlsJy/4iW20

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\709ae328b3aa434fe666e95b762e7dee_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0eff0a46c0d953ad4b9a80de29458c9c

SHA1
5017ac922a69c554ac13a93f751aeb26f1c4b7e0

SHA256
5a94fd180a8807f09bd4e95ef001da6e0916ffc48602bab911314a06ffc985d3

SHA512
6953ef5fe4455bf07d436722ab9f1886eb84f3961d5b6e8cdc21a1c4e1378bf65d7ed5bbb1bdccf4ec22868975c9022f18405700019ab8e20710ac0d6d1093c9

Download Submit