42cda821066a31f1bfe93bdb9569424641662a96018259bac936969340e98d21

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7219ad81117b9627d038aa3fbde1e63c_JaffaCakes118.pdf
Size

78KB
MD5

7219ad81117b9627d038aa3fbde1e63c
SHA1

9c4de27d78015f5013e08e7e8d5328ee367f3598
SHA256

42cda821066a31f1bfe93bdb9569424641662a96018259bac936969340e98d21
SHA512

775e7c1cb4abebd132b869d3bba7253a9e55f88ce9dd9113c8898ddb32dfbfad6d4bbfd41e59ef0a54bedde1aa1ca1b92ab4c6b448fec4f934a547ff9ed5ac79
SSDEEP

1536:yEU7dEmzIuSQMQhAAjQia0KvBBewrhbO0bpn2UkWmddnoFPwytnQWapOtQgCWoQR:gdhzbSQMJKa0qXrhb1t2UaddcwEJtQY9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2516	AcroRd32.exe
2516	AcroRd32.exe
2516	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7219ad81117b9627d038aa3fbde1e63c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e460bfa5b9799a3dc39186c9ba8dc241

SHA1
b0a896bc44dda74b692290071b8abb443d445e2d

SHA256
601536b11c2ed67e6fa8c4bc0537eb7ce61fef28e35c79c738f9d59a9da3b598

SHA512
7a058d1cc9f6e5a1fd985981538189aee67badf4cde791f88fa3fa2da03f865ef374b5c216a09da991133f28b13830df07d38e4417fcd5da53ab2435a5360a52

Download Submit