1c91410b95d9db1bbae480b166285bf6c842e057958569d7ba9959650f39cc5f

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93ba2aef6f0e6110972f542e2edcfe92_JaffaCakes118.pdf
Size

71KB
MD5

93ba2aef6f0e6110972f542e2edcfe92
SHA1

4e0830756e474a82eb063cd31f1ded557161347f
SHA256

1c91410b95d9db1bbae480b166285bf6c842e057958569d7ba9959650f39cc5f
SHA512

4930f4df639320fb62dc024b9ec9b0b8c48f4e7af56b6972a2606bb2305f1d26d0c0a78a10491ad6e20c1d44bbf6eb207b305dd977e1f2392facc8603bc0a206
SSDEEP

1536:H6ckgi6TB1INyBSmGFJ4wBjDalgmZ4nxxUgvxI4/M5+dYWp2+K5kHcu:15iI0ySm+J4wJDalgmZ4nxxdvxI40GYE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1472	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\93ba2aef6f0e6110972f542e2edcfe92_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f694738f15aecd68e001a69ea207b92d

SHA1
b6185bed61c9ae6eb5f15fc841e90bbf41bb31f2

SHA256
77c0953be43b0a61826bed2b57654385ec4a03bedd18b1a334209ea5e373a669

SHA512
991197524b09ecf9124bfd9ae9348b14c33ddbc96b7829067e874ec25528fad4d7d2d60f1158045737a650353f291ff1b7288705c2e730d0c6cec3db282bf63a

Download Submit