518980c314470a8f9856761105f297a4968e13206c2c6a598c0aa2ee3ca8e675

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

730fc31ea9c978ffc519f84abb87e36e_JaffaCakes118.pdf
Size

69KB
MD5

730fc31ea9c978ffc519f84abb87e36e
SHA1

a1be1d8a1163eb578f7f3416edf0d07933ee7aa4
SHA256

518980c314470a8f9856761105f297a4968e13206c2c6a598c0aa2ee3ca8e675
SHA512

0f5297398a8c01a32fe7810f6bf33a0ce6752662267de5af3c7fcfdfc0ee6f9a8cec53b7383ef5db9c6d5095a922733c43419fbf8f70ae6c0b2efa6230712863
SSDEEP

1536:NWgY79xPcYHwChI+b3SNYcBNTVT2WYpO2iaJG0BHFWWL6TlzBZnC0:cB799cYHrI+b3SWeNJT92iaJ1BHFQTlF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe
2664	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\730fc31ea9c978ffc519f84abb87e36e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
361385ddac6a5d739d7d4d6d5e5102aa

SHA1
258844a681c570e58afc197f4fbf55f2b5f0f196

SHA256
b352f81e2b92b287882cc372404b0d393e50010754a8a29d9a86ed02ea4bcbb1

SHA512
9927202339c2223934f8dc438e01c308afa324b8c2e017dce132af9670863ccd5e0f47e07a3ba926ec86427e9d5776ad24e984792dca3721f4bea9b16961f1ef

Download Submit