09645d652a8acebe6ecdde8adcd2c0d1ab094562c62109af48699ac82d53fa83

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74a7a4757011502a28181d479b91071d_JaffaCakes118.pdf
Size

62KB
MD5

74a7a4757011502a28181d479b91071d
SHA1

32ea7727a53d729e1f08a0c5cee45f3f6bcb88bb
SHA256

09645d652a8acebe6ecdde8adcd2c0d1ab094562c62109af48699ac82d53fa83
SHA512

56fd9a97765d1bb4e882314068ea870d5f1e789cf7e82e609cd20276d04e2b24c8d7042d0ddba07e23dd874cfae8c7dd32f486df2e4ba69e298e9cbc609e7aa1
SSDEEP

1536:sJK3EWVnaB49tRe59jl38NWKjN3mk0BGkEeqautZZWbpONiWwh6:q4EWVnaW9tRenCNW4N2DXEnZbNCh6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2252 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2252 AcroRd32.exe
2252 AcroRd32.exe
2252 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2252	AcroRd32.exe

pid	process
2252	AcroRd32.exe
2252	AcroRd32.exe
2252	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\74a7a4757011502a28181d479b91071d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
92cb973d69061664e71576b863e1185b

SHA1
9f1744a0ec0ddb748ccc7178e2a45fe893f696c2

SHA256
a28caaeaf5e382ab24e16d4f600b14a622d3ee1694d138077e4efcb5d0436bb5

SHA512
b92d937f61581177b8ba9d10950d80af2c23b5a25d58f0c16aefce8e0049a36cd3fab6149dcf63951c66c1fb618c2c7b119eb6bb38ee08b23291d46d96895b1b

Download Submit