24683042ff06d010ef9f2c0fe00c4240befc13a3d6e227b3c7f45958bfab3801

Analysis

max time kernel
95s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78794217823ca99d0b273c4c561cfdf2_JaffaCakes118.pdf
Size

84KB
MD5

78794217823ca99d0b273c4c561cfdf2
SHA1

7702672bd36ee32089d5b327bb5ad8c072484849
SHA256

24683042ff06d010ef9f2c0fe00c4240befc13a3d6e227b3c7f45958bfab3801
SHA512

b909fee739b5cabaca0b1595893506ce71574b695566219dcd5cbb780f51cb1f2e2c7c7147cec767d293221d03e347a50deacac73336d625da4e15dc0398e73f
SSDEEP

1536:fkbcMeXLgx/LU2LmqX7RBk27HIIz3evWAr6BfXTWepOycoIJcO:ucBXLwn6qrRh7oIreJuBPwyS3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2112	AcroRd32.exe
2112	AcroRd32.exe
2112	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\78794217823ca99d0b273c4c561cfdf2_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3bda3e47d97be5793cb3b30450b71d7c

SHA1
7117f1d4ae0a43a7c69cf4ff7b3796f6a65ab0a7

SHA256
b52b66f0b646deb40288d52ffd71eb95842fe7ca8204e9b0f4e800024b10e935

SHA512
6842e5437bcd2ba1279319aad5ad588adff53c037563ddeff371b94c5c58d6ab98b920bef982860265b90eb94e16918b3d1d854e61bd279e6dd8213e7e910b0c

Download Submit