5347a149434d020829fdc1954c9fa9519c2e6436399224ea14436422a39bc518

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74ae526098d1a9ff89818bff936683b5_JaffaCakes118.pdf
Size

33KB
MD5

74ae526098d1a9ff89818bff936683b5
SHA1

4a93d0af5d8d570a334b9de9ec30dd1b0c2d589a
SHA256

5347a149434d020829fdc1954c9fa9519c2e6436399224ea14436422a39bc518
SHA512

fd8f67cf8f9374af2a9ca87a9052cec997fe1a8a408df378fa148a1e621cb5dc8ef9cccc727f582865d0351775a3f3536b879c11907026859c1d3ab849ea9b2d
SSDEEP

768:L0ZAC2vNPxfSZtUmZnMHZaRE5fNSAzi6nSa:XC8xfMNZMHZTFNida

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1188	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1188	AcroRd32.exe
1188	AcroRd32.exe
1188	AcroRd32.exe
1188	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\74ae526098d1a9ff89818bff936683b5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f3beaeaf3a0ea6c59bc459e0d9737005

SHA1
1196cc5010ad9cc5e27bea83c6c4e052d2e7b3b1

SHA256
c3fafaf605f8ff56221e2c665e6c43391c29b923eca785db10994a99aef63ec7

SHA512
2194a33287b47441bff2d322d09e6a9cec587c82b50451018ed5e5aebe62e982ac7b512cd32d97c9eb28887270d72056888050e8ee452bdb4cba143b3578d569

Download Submit