d94d5ec8f41e1c4bc63b13e3a2cdb7a6da8e3158f7fe5ae977f6987a71b2626d

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87023788bda08be8268369d5b92ec7ff_JaffaCakes118.pdf
Size

99KB
MD5

87023788bda08be8268369d5b92ec7ff
SHA1

bd1c71cd3e0abf4cfd3adb3633861d2828f57f15
SHA256

d94d5ec8f41e1c4bc63b13e3a2cdb7a6da8e3158f7fe5ae977f6987a71b2626d
SHA512

94b331b17d282674fec494db89cd1ccb6b4f3726c54b8aa44bf87c19c9de58d1a8ea630d0796570a3ffdbd16edafc77705f69a4d258ddd310034d947a8c3ea3e
SSDEEP

3072:7eN9u/AOJ5ezYPnb9ctDi+oOnU8j9Y0ZwQ:7G9+km9Q2fiz3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2164	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2164	AcroRd32.exe
2164	AcroRd32.exe
2164	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\87023788bda08be8268369d5b92ec7ff_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
28baa85affd35daf41fdb0a5da0ff1b7

SHA1
2861dcc2e98c85a26b229599c78c678c65844784

SHA256
b22c8ea6a201a4192d2e051473e06c43f590f428a885ea02bc460ddab7e79176

SHA512
14e82ef231ceceba889b4cfef45345793b087bcc720cc6b396c781e3972882b2a086c53fbb720e5a3fa9a64c39d6972f5540e6728229f48e9ae5943398bbfaeb

Download Submit