9b0624cad0c32022fff363dfdd593c779049a5da3d6a6d50bcba9cdf25d78e59

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

753de2fae557a142e26ac187ec4ef370_JaffaCakes118.pdf
Size

65KB
MD5

753de2fae557a142e26ac187ec4ef370
SHA1

10203398ab09aef32f6f8a4151b5bddb153dcc34
SHA256

9b0624cad0c32022fff363dfdd593c779049a5da3d6a6d50bcba9cdf25d78e59
SHA512

62e40c7ed3aa8f763c994edf06852989a93905b0ac715db04840fc5905e750890529b7a3218fe874c3bedd6b7cfd8e791dd69cec0c6b0c9ff779b55402a28625
SSDEEP

1536:2zP1TshSqAKABBtUiq8FYlDJRqAYlCelSn9t3ZfqVbVX9w5u8:jhSZ6CFgJRqcFnfpfqVbcr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3044	AcroRd32.exe
3044	AcroRd32.exe
3044	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\753de2fae557a142e26ac187ec4ef370_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1c40731c07c94cf5f03dfcb560e6a376

SHA1
15f2c9adb1bbc9dfd5268ffb4aa4eee154e66eb2

SHA256
64d21bf3e2a18c1080e1cc2b64963ca25402b0121b184d13f112ba7536692ccd

SHA512
f9fd2efdbdc0b88be189115ce7a6aebfa48297cdf29e50c30619626208fa82b7821b80b104d633700b609b9f4e0499c177dcbd4878c19ff98febe3af8a5dc836

Download Submit