0dfa2e22ad8da719777758403c265cff8161671e8fb7cfcca40d4bf70603d201

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741de703a2d1fc3d11327c946429728e_JaffaCakes118.pdf
Size

83KB
MD5

741de703a2d1fc3d11327c946429728e
SHA1

93d9e8c5397ffebac2c913d4cbf9df47ad7096df
SHA256

0dfa2e22ad8da719777758403c265cff8161671e8fb7cfcca40d4bf70603d201
SHA512

93bde6a75bfc77794ef60d93276fddd90610bea61942c54d454e464579b4f5dee7f9c92af967a41104e8abd9db7e66038f1a6833a0f8919490302e913f3a703d
SSDEEP

1536:iNvIXjwQG1tixtfxt+P5nwHTGYF8lxQOx5DrHOWOpOwrKWX9xVl7KYr+:qvIXEQGDEtfxu5wHT96xxdrHjwrh9duZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1400	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1400	AcroRd32.exe
1400	AcroRd32.exe
1400	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\741de703a2d1fc3d11327c946429728e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4888cdafe9fc761a862fff8514f6cf36

SHA1
28048b853b4e4c356c4473728ab66c2765269eae

SHA256
0adb6eb433a62bb4e795e4333515795c917ea625100af19ba416c466bc083386

SHA512
c9e3dd26decde8db3195c4eeade46f35768f6d89f869e214411c6c5ec85c696f2fb8cadd94ee70028cb16dd6fa8494fc9d2ac9b8ee2f7eed7176eff68a1c64dd

Download Submit