855b07c0f7880f05a7080a39eb797e65011aaa1c8d9560a442f7d95876576797

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a72892d45fa84ed0e4e72115334e6725_JaffaCakes118.pdf
Size

78KB
MD5

a72892d45fa84ed0e4e72115334e6725
SHA1

20c277bb753a9b3d07c1f45142bb2f0490793245
SHA256

855b07c0f7880f05a7080a39eb797e65011aaa1c8d9560a442f7d95876576797
SHA512

1ade790daa4a904fbcfc7e5165941071335615e1a20f0c30f3bac112db3d8620848212d028b3f9c849ce399b3149fae61984db0a836a12a4df7bb82ad48f8bc7
SSDEEP

1536:y5o9XyAiiDymJgV/O/tsxO4eRFdquYF969ePlDaz6W+Bn5ImA9AWQpOCjhbeC88N:AoMfEeROlr4eRzquUQ9WlmUl5/A9vCjF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3004	AcroRd32.exe
3004	AcroRd32.exe
3004	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a72892d45fa84ed0e4e72115334e6725_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
257b1f3643ba82d73be7249967bc8ad0

SHA1
dedbdd1b1ab2f2fbd0a6d5efd858b571a413d8d3

SHA256
b5da62c6d42b3e88ed8cfc81448df2bb1d98d040ebb98ebbed0f1f0024c22d27

SHA512
c289f7817421eff3c504814aeed9524b46cc2751ca36c7c5ba5c7f9dec793a59b71413c3d7b3390c29722cb4819ba8bb2af89834d242759a9affbc40539e7739

Download Submit