9373735cda513c809ad999c3688cef0177567127bf48dc67dceef139aab7c6bd

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

880fb9c28bf0180073bd1c2ab23d6f48_JaffaCakes118.pdf
Size

42KB
MD5

880fb9c28bf0180073bd1c2ab23d6f48
SHA1

a6d70bad985facf4fd315c7f0306afcd96160cca
SHA256

9373735cda513c809ad999c3688cef0177567127bf48dc67dceef139aab7c6bd
SHA512

27ae0d184b9f8932393c3fc6f05dd42e57ccbd613e1810c866e6165ec5eab6b43db87755cbf5993372c90f44ef1997237860f6f18574135c25db86f0a12605aa
SSDEEP

768:0gGzpD5AzPw0ar197BrPJzQ6UXppl4WQq72Kpm0vRUBfQcJZzRcZ:BGFNRBNzVUnFQw7pB5UBRJdRcZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2352	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2352	AcroRd32.exe
2352	AcroRd32.exe
2352	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\880fb9c28bf0180073bd1c2ab23d6f48_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0d42e559c3a15746372798da6907410a

SHA1
8e1a36809f69b19423018fcfa24171dc2182c9b3

SHA256
dd6165df363e1b3dfcf9a59ccebeaf28093f7e972929d08416b1a382c86874df

SHA512
c6a9ad288ff4d1ba7d5d6f2a2555c1cd42cb35884f6d1497f75dc5907aa0dd0e319ede7bc62612866e7aed50ac26ca0ac52704573c65a749866dd06ecd2fbe3f

Download Submit