5d76bf543b294755fbd8e0d139ee890ee1592c44b71721dc890e1472758a433c

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

725db2701f7a375cac43a39131bda5a1_JaffaCakes118.pdf
Size

78KB
MD5

725db2701f7a375cac43a39131bda5a1
SHA1

0b8cba7d3a3a40a58a45846fa97f8f0b6c065ff4
SHA256

5d76bf543b294755fbd8e0d139ee890ee1592c44b71721dc890e1472758a433c
SHA512

e1b453cfd9adf9c7db727a83142bfae0652f7c359738fc67758a68fa6843544ef0276cdaf224c5be98ddf48c17d3de824f0193464e25d020074e66e2f762376e
SSDEEP

1536:Aze9oesX3g0XJ1uZzKvCiswwi9H4vnWOpOwrqfsi7bWk9S9AiE0:yemX3g07u0swwi9hwrqfs039pA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2476	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2476	AcroRd32.exe
2476	AcroRd32.exe
2476	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\725db2701f7a375cac43a39131bda5a1_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ee1de1b81f5ed2a13992a172c44a6fe

SHA1
fb7a50790a699235be19d29877a14632ee691e3b

SHA256
16d346b1df5409c9db2f247015997d985c0c3927a82ede3067a7264a1251439c

SHA512
8ca51346f40e06f4bc34e81142702b7a060552f2a10eab06b5a09a96a8a417b53e0fc9027bb21737f0b897640420b4634fdb0f99e1a80b91961b379dbb144f2f

Download Submit