2df09524785e5224275c03073859156ed8a9e17d58a91c632c0070a5b46ee1ff

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7f7c725b280c95f2a57a86c2d1cb89b_JaffaCakes118.pdf
Size

90KB
MD5

a7f7c725b280c95f2a57a86c2d1cb89b
SHA1

560700394a82020f18d417ff83fd47ef8f971390
SHA256

2df09524785e5224275c03073859156ed8a9e17d58a91c632c0070a5b46ee1ff
SHA512

15a8c0b0b5023da7ea4d8ed4f4350b34c7f92dcf547d36e08ad404de9e35c8f4afa94090d8e92a1504cac612792203993f5d837c2fbd44887ba56ddfeaf3d6ae
SSDEEP

1536:apvTM0LFS70+kyTtySzTv82Edb1DovuzxtGu+mm34a3jPrBrWrzrvJ+MYqtqRCWC:gM+0Rnv8dbyvuzxtGuy9jPrBAz/j8LiV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	AcroRd32.exe
1716	AcroRd32.exe
1716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a7f7c725b280c95f2a57a86c2d1cb89b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
86c84526f721c41ba78c7e202ccba0a6

SHA1
1f72587331dedbabb1c33b66eeaf2e555fcfb9b0

SHA256
1d91b8f16edffa7a35e5f5990b99ec1c1718ab88d7ba3490ce659017a7c66b6c

SHA512
aa1626ec9401d432a98d413a480c005e0f31b4965b264794ef1ca0bd82e397f55f288c7649576f12fcaae012c12bb212dac1ee851d065f6df68551f2066a476b

Download Submit