8955597d8e64962de72aa957c3ad8a7cae7c525cb4f93aaec86617fc91a41768

Analysis

max time kernel
91s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95d213c76efd21118e03d28cf69d03e4_JaffaCakes118.pdf
Size

31KB
MD5

95d213c76efd21118e03d28cf69d03e4
SHA1

16c7aa807e71bc47089736cc6fac05e7d49f345d
SHA256

8955597d8e64962de72aa957c3ad8a7cae7c525cb4f93aaec86617fc91a41768
SHA512

705a0cfc36955f53815485d4e30c0ab26303eda7047328bfbe8a19f01815e2ce84dac6e49019068e75eab2e73a84debdc899ee3ae50b77bcbe684325c4c27306
SSDEEP

768:IXuMZmwgCLWar7NG3URUIyf7I6pTiGuwlW//B4PmA:IXFZmGWS7NrUIC7I6pTiGuwlW/ZymA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2336	AcroRd32.exe
2336	AcroRd32.exe
2336	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\95d213c76efd21118e03d28cf69d03e4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e5ebf23ba468423bc18f8b5000a796df

SHA1
ad8002d3a9d7202a9b569351dfa8b73758e04519

SHA256
cc7b49c3aa73ac2a1bbe8a8d6473b573abdc4e292a199e21636eb7682184c02c

SHA512
2242ed5f3d4c7aff1b5da3cf4d09f658f2374b1956ccbe686eefe1e979cafe42bfbbd0d876d98e4dbf7e1166264ad6f1c7a8db06639459de62ba1b6865adf2e0

Download Submit