2816ac0be5e84b3671633181cc136508d8c309e641786f113d8e10f4660dbb92

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a70f76fb0eb196fed6a00a0a626e7ec5_JaffaCakes118.pdf
Size

9KB
MD5

a70f76fb0eb196fed6a00a0a626e7ec5
SHA1

243131adef9bdaf5ce9cf9529f5d699899df430e
SHA256

2816ac0be5e84b3671633181cc136508d8c309e641786f113d8e10f4660dbb92
SHA512

3215871f7f8180970a0fefa22b96108ce391059f72aacf8c9abb445fedda75edaba349b14827637aa6437996ecc419b2da2e8b764dede5c2b3dd21c838dcaaa0
SSDEEP

192:680lftYQ42S+bRdI30T1Caz0L7/ILg7QL0dlywsTtqscTxHC/JM:68GftYQXg0T1IF5lsTcsj/q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
484	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
484	AcroRd32.exe
484	AcroRd32.exe
484	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a70f76fb0eb196fed6a00a0a626e7ec5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1f4ddb3e80f2c99aea0186ddd8540b4e

SHA1
695843dc945d18dedba4b3bbcd6580e8e575b387

SHA256
37d35352aca755e65cc5ecd8360782c5a0b170bd7b615a62097aa8278d2b3f57

SHA512
37579046cd8a8213bd913be7d67a5fd144eef562b610fd297bb84edc5da208bf7b7fe7d32174bf87f07c8565e184bf639b5af7c9d9bdbce1869c391d04f55a15

Download Submit