35b75fed90fe9b79445703bd3c9fe476d067232571ba558b6e3a47c0d42107a3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85f47cc733dbc57c0c2704b7954e35de_JaffaCakes118.pdf
Size

34KB
MD5

85f47cc733dbc57c0c2704b7954e35de
SHA1

70df347129c032db77df4d2d43698c3b803e1f44
SHA256

35b75fed90fe9b79445703bd3c9fe476d067232571ba558b6e3a47c0d42107a3
SHA512

696d76a869bc0102b0e0a2cb29d737a0f0c123b958dd11c212c69c6b8c9bb5852a3b024a7c55112f76989ef4f93ea14ded6afdfa19587403c8fe6e43faaaa10d
SSDEEP

768:XTYOtRkp270erHw16FTY/vmw4RkF/Wl6e9lsz9P:jYOtJ70YyCTkvmqFOhSz9P

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\85f47cc733dbc57c0c2704b7954e35de_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b7c5c40ed5c0387fc59e4a40bb63be11

SHA1
8e3f7e79420ee8775aa4fc072ee066089bfd93ec

SHA256
e954bde19fa9b646d2a26cd06cfe2c48934611f52c70ae8d92bbdc573daab626

SHA512
42b098d4e61ec0116967456371fa3728f1c31b58a152dde060b97beaa43997a951accca7f6eba758a8e3531c5d18fce34096c64687b26d7eef24e52ccf0f6ff4

Download Submit