13140d7d59aa842e6c428d942f52f09797ed2d6b57760769dca778be16850aff

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ada7989422b23c1f2250cfb4735b3855_JaffaCakes118.pdf
Size

83KB
MD5

ada7989422b23c1f2250cfb4735b3855
SHA1

2aa9a49ac05a2eccd235de576562d4dd7804cf85
SHA256

13140d7d59aa842e6c428d942f52f09797ed2d6b57760769dca778be16850aff
SHA512

90e85c3f5610b9dfe10099e120314e84d533d7ebf730392837dc65efdaae752ebfcd76d48debb9914a52a570711682e5ae8573d86e5ac1a5f5429aaa0912d04a
SSDEEP

1536:uQ9ivpc8D4rMxCo/KEKf6HU4UJsmiP9vuGgzWOpOwrKWMvjnLRlf4:Ngc8D4rOHpHUvsVgQwrApG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ada7989422b23c1f2250cfb4735b3855_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2d9dc37bfc39fbe5faeeb17da21d9597

SHA1
fe7d431f1f89ded625dc8bca3294194356c0aad0

SHA256
c287e467df59ddfa15498aa7f951a7b0f6a684e7979920b115858143d98282e9

SHA512
17eeafd019a2d61dcff6728a10cd73728d78a6019a65df3ef768fc3bda8a0fdc28845b3d84ee04c6856eb9680505c7de2cd2ff82f1a708cf1f01346482616d17

Download Submit