a7cd60157538a98f3d4aeb914bb306a3764e36f435c8305ee146101d163cab8d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

863f24ba99cbbed2abb1b8187f7ac3d2_JaffaCakes118.pdf
Size

71KB
MD5

863f24ba99cbbed2abb1b8187f7ac3d2
SHA1

852364af080737254a1accb106e869054e405923
SHA256

a7cd60157538a98f3d4aeb914bb306a3764e36f435c8305ee146101d163cab8d
SHA512

a81b636b3779a6cadcf260e75c9d706f1632433456a376bcd21eb6353dafdbcb0173464a12a427b28a762fa0147837049223f42ccabf9946adcf53d137d83abf
SSDEEP

1536:+n8JAwhzb5z/YDWd23yfNe9yCDTR8VjgUCt7ghtVrDn:48JAGzVDcWd2Zg+TIjgttshtVv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe
2892	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\863f24ba99cbbed2abb1b8187f7ac3d2_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
827b0b9865441dcffef5708dfa1b3345

SHA1
dc165341e6e3926bb28dcfadd7c78c89f0b25ec6

SHA256
f891b10bb8d0aa8b2380b8efc2eae21327cefe6aa69e87fce5a2275da3375152

SHA512
8009f8fe4a7959dc5d72178323efa2defd8541de5a890b45b01839855501def1c62ea888210bd11116b41725dc3d54f3fae0e1d441da2b4be1fc1a2e4c1b2e8d

Download Submit