6e7668f8cc9709f05d6d1e0d1c2beace41044a111d3326a48a263c1dba34b5c1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

833cc7390bfbba21e56778d66d5a1e21_JaffaCakes118.pdf
Size

75KB
MD5

833cc7390bfbba21e56778d66d5a1e21
SHA1

70a697e6d95235ce2329460aad760202f1cdd8c6
SHA256

6e7668f8cc9709f05d6d1e0d1c2beace41044a111d3326a48a263c1dba34b5c1
SHA512

28579c582f94e211c2fb163cff54f325941a0085e2b7fbcaefaac944a2cdcf61045d25213636b1416fdc141925ac6a46bf365fceea348609f94f425fe0caa749
SSDEEP

1536:7Y3uMj2QtGszBFUY8nVizS3Oa3PmWgSOUFWHpOvg/SW0mK6WsfOeHOX7Q2QO+:iuMj9tPFD8VizSbfdgSVjv/d71LVC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3036	AcroRd32.exe
3036	AcroRd32.exe
3036	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\833cc7390bfbba21e56778d66d5a1e21_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c90f57f0f1e7a6eb79a395e74a4b35c9

SHA1
689f3568eb78fb155e82da2c0193a39daf9035e0

SHA256
13c59a605ce80a5387d91c9c686c8ba923331174d5bf9a0806c2e1a13fda41b8

SHA512
1e0c8c67a4e8bfa3081be5e064fe2e4d6b67cdb94b6f548bf7085a8016d46821b1aff68a625276258797741d7ec0cf442734ecfec7f329a37b931aede006749f

Download Submit