05ff925daa5e990a7b536694ae2f078703aa1145d42cb05d240faf72260f534a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a7785c3644f5a44170c643e42cfc57b_JaffaCakes118.pdf
Size

90KB
MD5

8a7785c3644f5a44170c643e42cfc57b
SHA1

750b68e44b56b931414b516d6ac56ef80b25a46e
SHA256

05ff925daa5e990a7b536694ae2f078703aa1145d42cb05d240faf72260f534a
SHA512

cb03f3d8c42e6e88b8218673bde578788048746ac1347e7eb62e841f6b08b20059e3d199f1e5e69d6eafdcee0209c3dadedd021028f8e76eb4f5017689b62a1b
SSDEEP

1536:zUefgFXtGLJV89JgsHy8tGvHMdZfjdmK/lZid18y03PZqiTlxRWGpOmJWpLv9m5O:tfwtGcLgN8kHMdJx7Wgf3imWL9m5/g+k

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe
2716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8a7785c3644f5a44170c643e42cfc57b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7cc5cf8e0772dabb92ee73c3fe2cda08

SHA1
8e1aa4820aa2e064183191355f963ba8fc8850b6

SHA256
0fdd995ca2be5ab2d54600eb118d9cae01760ee921865292497f23e0ecd31f14

SHA512
68a26ab27d3316a0980a3d4dbbbbfdee0169644500360f7b430244f4f946a6283a2c61f5ae17b53611b0ecce592d6be76096b5083fc5d69bb75bd736915a005b

Download Submit