c62d6802e1f7ef947ba09e34b8c178e355fcf4ff8c3361de0a21e714bafd4965

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75b3dd3e7acd243e91f4f960840f5442_JaffaCakes118.pdf
Size

68KB
MD5

75b3dd3e7acd243e91f4f960840f5442
SHA1

439727f3bf2a97346afffed6797e8e228c4df1e0
SHA256

c62d6802e1f7ef947ba09e34b8c178e355fcf4ff8c3361de0a21e714bafd4965
SHA512

86406ea0bf94197f73898ee760725956fe6b813993c1f9184a76fc5a46422686a147511361691003a9d766426f1e75af63837847c96508cec5380f35b84dd9f9
SSDEEP

1536:TR6RTx4zLlTV3PjtcsiNw4WGxe252Pb8+dX2m:V6RdmtVbtc5NwxGxe8mwzm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1040	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1040	AcroRd32.exe
1040	AcroRd32.exe
1040	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\75b3dd3e7acd243e91f4f960840f5442_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
513aabe38db868a44d7eb6073a7d15e9

SHA1
2c93c4637fe120e210039b67ff182ea348553b57

SHA256
ca5924cfe9bbce87f83f131dfd28f80016fa2338dd981e92dbe9079108dec733

SHA512
159942544ed326578c8504f046cbb00cefda60323910afe852c16a513997d801f4b04014cf033fc666d7a9088ab6573a2853ca44d003fc2db85d6347e955e35d

Download Submit