67066d7c0d4fb48b3826538c0d88369c4dd3817d166e1ccedeef633845313f24

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76b5000ad14c180c90d807d7cc18f5b8_JaffaCakes118.pdf
Size

34KB
MD5

76b5000ad14c180c90d807d7cc18f5b8
SHA1

3661ca7bb0337c901a069a52e6be9e15ce6bd62c
SHA256

67066d7c0d4fb48b3826538c0d88369c4dd3817d166e1ccedeef633845313f24
SHA512

952a2dfd966728016b2964ef3fcbaefe1b477bf312bc9ca5091ba72acd9e9d6445f516065c2ec257b40ae020eee31b233a46edb44ef7ce34f576d0f6bb345e2f
SSDEEP

768:aH/MguNwY2skk1c/o5hA6VhcIusj2HXWyeL9wj2:i/MgWwYaQM6bcIuZGyeSj2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1148	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1148	AcroRd32.exe
1148	AcroRd32.exe
1148	AcroRd32.exe
1148	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\76b5000ad14c180c90d807d7cc18f5b8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1b11129809213835425c2ea3dbf30488

SHA1
9864a24a757695d3dd39743edf471824681badf9

SHA256
5a2ba10d756b461f277accdbc3363084ea3fa525066cad6fd378e5426938bf7a

SHA512
abf8453102d9ca41ed7ff02bf2d799625bda6f4f285b05e06797ad521a403370d829f961440fc5f412f3506f0db64c7db48c1da67d49c8bd4017490d9828a3cd

Download Submit