f909d2f59b887ca2d86c77fd65341a7e5034566bc9fa6e4d2b67ce5eb68b42ab

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86a73890ed96461c5ca62c82b74adfb8_JaffaCakes118.pdf
Size

43KB
MD5

86a73890ed96461c5ca62c82b74adfb8
SHA1

296e799ce6ccddea8259c80671cd1f940c4f6e3c
SHA256

f909d2f59b887ca2d86c77fd65341a7e5034566bc9fa6e4d2b67ce5eb68b42ab
SHA512

eea95f799f01ba0e9a4459a170b2e577ca05154fd904d2cec72a828960e8b0bb57e8efc30b334841a7215f9880626742bb0cb51779bf7885e395ead288af5016
SSDEEP

768:rpGIuhPwDFrzidDC6s2DpjcD6pYHTDMIHxob+r4VJDp5CvVfwtc/+7:rpGnhoprzidJNGUIHxprwDp8vV6H7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1756	AcroRd32.exe
1756	AcroRd32.exe
1756	AcroRd32.exe
1756	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\86a73890ed96461c5ca62c82b74adfb8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
55006a20163d0164132d0c6cfaaeca16

SHA1
f623489a76543b80dedeebee19fff6ebe4c1ba67

SHA256
e86ca9777f93079eeb292746f69372a96117d9ab5b8bb12e745e1474033044e1

SHA512
bdc7561f18582240a2be6a58b2d36b60c704aa719c49c138a49fc82f0a52ebc76350e70a8462682df97b178895025e3a47428243d0b6145f9bb8d8a4cc280f0d

Download Submit