0d8577eac70e1c8918e7b76eecb5d864d898b7655b2e5a59f630ebb670221a3b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a355802ad879f43b9e5d86dd7869055b_JaffaCakes118.pdf
Size

76KB
MD5

a355802ad879f43b9e5d86dd7869055b
SHA1

0a71d2354cf90f71c45ff831fcf430250c7c6a4b
SHA256

0d8577eac70e1c8918e7b76eecb5d864d898b7655b2e5a59f630ebb670221a3b
SHA512

ea6975ae589f324f970f3b22bb5c1fd24fe8e6f2cc049f06fb77d365c59022446a613daabbce701ef3d9e98c7b6efd0fb748668b207fe3503df286ee5c043065
SSDEEP

1536:M1gx8vFfokAfppm6KwZKg+UREu5mZQ4C7jsfHuW6OtAa4i7FrzHMtQLWQpOCV:i4WlokAvUwZG65mZNKj0Wa4uKtQ2CV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a355802ad879f43b9e5d86dd7869055b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3a5d560146902759df9d1d494c10f338

SHA1
50f007204498888e7cbed19fcac5b61bcccd3561

SHA256
cefe826f0f07b1446c6005c8c34f5f0bf3b5b45d1d336725fe39b21bff97839e

SHA512
d3cd4d77a57c154e5e74cd3622c7b4821bed991d95a84a374adf379507719e0c35eb1b9fa0a4de2d46b1064a11ba275ed0430556ba7047f5b982974c7d09499a

Download Submit