785cf5875d17d43f57f7646fcc226db57fd6f5c123566d4d721c05bc9f2cd0ac

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74bfdf33c3a916a2dcb16c5986c4c8e0_JaffaCakes118.pdf
Size

94KB
MD5

74bfdf33c3a916a2dcb16c5986c4c8e0
SHA1

21d3f91f92c6c6193e3dd431ff71847a530c6429
SHA256

785cf5875d17d43f57f7646fcc226db57fd6f5c123566d4d721c05bc9f2cd0ac
SHA512

c90c3974fd23708f7324c7b83b2362fa80499f200601e0794399faa9bf146ab444d3108aed35871eb1acd57cadeeb67b50f9ca89dcf8144714c45d593cd97f95
SSDEEP

1536:xyABUHc4gLwCn40tOOkdhxexSmCIE7/hrvWdgk6UWApO6Lye/IFf4v:ecZLjROOkdhxiVELogk6j6OeN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2712 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2712 AcroRd32.exe
2712 AcroRd32.exe
2712 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2712	AcroRd32.exe

pid	process
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\74bfdf33c3a916a2dcb16c5986c4c8e0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91d01e4196ffd89ee109ff398cec7974

SHA1
39fb13b420d559064c4879b4a9723d4e0fcda689

SHA256
3cf2d8bc89f4fdbcb679039ca96197c3d056fd161719dbf40fc0ca9a6685441e

SHA512
0a7eeda8933540a84e0a55188a8cb4b4082a57f7febb00e1e4f1f87477103052535369f84fa3fca09a04be93c963348f8e94cc8d7e1b8a670be3ed3b134f4684

Download Submit