1f2234c27ff3f221eac4a4f1a0fa27acdce386ce2b8cc216fea779bea39b0a13

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77d37fca11db7dab01dba4ca3badb928_JaffaCakes118.pdf
Size

75KB
MD5

77d37fca11db7dab01dba4ca3badb928
SHA1

fa8acbf27dca728d73cc5502e31af817e7106884
SHA256

1f2234c27ff3f221eac4a4f1a0fa27acdce386ce2b8cc216fea779bea39b0a13
SHA512

b8ab590451bf0140a2b50f1a2e62e9b2cc2994e32f7a2cf6ca6787ef1787287f4a35698d16794c17750c2c2b1962293c05d142c443d66bbbaea43d0a8f031560
SSDEEP

1536:QRV5V4R7oKqZ0aU7YOFcvv7gWfghPKWOpOwrKWIkUxU0q8pT6:A2RkG7YOE7xIwrKJy18A

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe
2644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\77d37fca11db7dab01dba4ca3badb928_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eae683efe6d9893a0411c895037c3c45

SHA1
651a60d366bf7b708ee75ea2a44111a096e45845

SHA256
ba1c48b9a719f817f8e73106ed29cbfb32f3dd4e713252e740655886e1983dd4

SHA512
6bd0dcde092ec88d8986e7399e69289d39492c26779d149efb8d07655987011fc3d59d2e94d79261beafaa3726989db8812492a89698bfa74ac1b50ef5646b23

Download Submit