8536071f78aadd47d1bfb455dc65d8426a5e20bd98c7770c151af19928aa94e1

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

745a299c45f5b03f0a65e54c963302c3_JaffaCakes118.pdf
Size

89KB
MD5

745a299c45f5b03f0a65e54c963302c3
SHA1

9f46f5874a29a73d5af02fcb013f019d44632c7b
SHA256

8536071f78aadd47d1bfb455dc65d8426a5e20bd98c7770c151af19928aa94e1
SHA512

109317139a97da9783e06f40dc7faf1a744a829636e889d6a8507785ff0be35e046adb631a44f33c30452fa8e285a9a30fe815ea28a3eb3b6b2f0cac46a059cf
SSDEEP

1536:tcEnYcZWQJKm5uhXW/bBnY+L5g9umSrgK1iwOjDOWKbWsI5vygoSWUpO7mD2qQ:SsZWc0XCUumSrgwOeWKNIloN7Ye

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3004	AcroRd32.exe
3004	AcroRd32.exe
3004	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\745a299c45f5b03f0a65e54c963302c3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a104a07bcac98c8dd84784ca439e8c07

SHA1
eac3d31249581975fd51ed910f0ed21f77ef0a53

SHA256
e12302ab044de77baf9a4c36989ee1817eb00c9e159642353ca5b7970355e772

SHA512
c35e6d23e427bde18bb8dd02c1b4671b46b24c46ac5516df649a8ec3a0b51ad71872a8cd6808d1f6d54ba6c36a431b48690ab04376d788ef4f9778add9628fb6

Download Submit