9910ae3d6edefd39bffbbfd858517e26e0868d3e8aa65c710588847920456f7a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73b049146545dc4180ffb2cd021cef02_JaffaCakes118.pdf
Size

83KB
MD5

73b049146545dc4180ffb2cd021cef02
SHA1

43725c75967e663f437e2f471926626cb239f740
SHA256

9910ae3d6edefd39bffbbfd858517e26e0868d3e8aa65c710588847920456f7a
SHA512

aab02060c24b12d015f50ff6c04c5a7e7103fbb23f6b7d6ad2625bf54d30b048e28f61d3ba1ff62b282191cce7fdb65ca02eea90662244e4272d79b0f8ecedd3
SSDEEP

1536:mG0DSMg9h3zIX12eqfgrhvJ6lQxcNH4Wb/HsCCMJ7oIAZxWGpOmoFu:jASV35tgrZJ6lQyNTBtaIUCmV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2256	AcroRd32.exe
2256	AcroRd32.exe
2256	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\73b049146545dc4180ffb2cd021cef02_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
da7657745214796e876bbe3f0197ffb3

SHA1
99dfc40bd9503f768d42f2c0addb75e4f64a1474

SHA256
0dfbfe8325ce3fc9a07efa76409635eea31d9f86e937d09cdf140a8204f4795d

SHA512
72b2a316ae042faa6b6d1ebe417b1a8074eb67ae46c2a95e689475cbacfe7bd0b6bfea19bb814953a53158f0f7283779faf39834c36ee950e98570e27a35d3bb

Download Submit