fae00b626bb3d337165e9aaaf450752d981725094b8b3fa8b7dd38a3c27c1340

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c399b83fe471a722f72a569158711a7_JaffaCakes118.pdf
Size

87KB
MD5

8c399b83fe471a722f72a569158711a7
SHA1

d9a7f7956ae03145f0cb14729d8cd7613bd3b310
SHA256

fae00b626bb3d337165e9aaaf450752d981725094b8b3fa8b7dd38a3c27c1340
SHA512

24febf2bf6e3ddb6a86e8a03720736d0f7691696479a4feae70d59d2928941b64171d079b613b7473945466db98c0a7576225714dc06954bb1aa5329d386f2ff
SSDEEP

1536:fjDIw90l+7WMUVgDgLhxwBxKCfGOZ34CNGV/6TM/7YO9sv0I+2J9wyTWUpO7qWzE:Fi3MUVjLoBxlfJZ3hGNIQMNj74yG7Iua

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1452	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1452	AcroRd32.exe
1452	AcroRd32.exe
1452	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8c399b83fe471a722f72a569158711a7_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
06a52a3f8aa26edbad489ac61d9417f8

SHA1
a76eea97047b9c649c60a8b1c564c25294d49a2f

SHA256
56fe27e1007fc06d720d86e0d6e4392cbe8b1c4c32f28c354940cc3ffe6495ab

SHA512
0a008e303cf9342480910777b5e01f4fe8c9583d1de1aa2d9ff9c841091b783e0e67d6881a1b061f4ac8d3c3e7a2e04f8a40d13a762bb7fe62a2a1e79de757dc

Download Submit