a8e22b83778b4b4db3c33cae4d4e84ee40f74895cf3684d24bef62fdd184c760

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

721aae9953810bd67035b131c5b7de42_JaffaCakes118.pdf
Size

93KB
MD5

721aae9953810bd67035b131c5b7de42
SHA1

4792184ec77a8823df7dc41b15bf2a408cc127a4
SHA256

a8e22b83778b4b4db3c33cae4d4e84ee40f74895cf3684d24bef62fdd184c760
SHA512

818646eb5319bd6d7fe58a13092838ba9ea1e9f644a56e55534ed083c2be3a6e45f843b4dbdcdb1a4f14b92c263bf6993b7afce0a1e5884718a46b861c4ea523
SSDEEP

1536:5lYeWW8iCU9KaffR6B29EaE+vZD3VHEfuwWoEGfa3vGFvwiRkfVAWUpO76qO:DE1i5KuR6B29DPGi/GFvwiCfd7s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\721aae9953810bd67035b131c5b7de42_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dc8c7994b770bd1b8a1372c0ae4a1a78

SHA1
79d3965d39051ca7e937cc27083507e85b49a542

SHA256
4ef30caf5d6ff6ca592ad492271efcbd51e23e3e29df2bdc4ff8f0a2df676a91

SHA512
62dac6d7775a97bf4f8a9f1b12411c335080d4348a2256ab124fcddb75b193f5cb2e8581d0aac43c6a941ab67d398a32dd05798b9aae63ff841dcfee2dc9a8d5

Download Submit