74f043e09bda40930937fab41f86779dc7445f28dcc2792ec3ec4dfb030c0ab7

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae644e06fd2fd90ce0feffae51a2a93c_JaffaCakes118.pdf
Size

79KB
MD5

ae644e06fd2fd90ce0feffae51a2a93c
SHA1

60228431345db37847b7c153d3962c33916f45cc
SHA256

74f043e09bda40930937fab41f86779dc7445f28dcc2792ec3ec4dfb030c0ab7
SHA512

90c82e258c3bb8f088bdd46be6a6ddf53a7204d9699e981ce142aec6e9233b823ae6e0a14c582ad90d2df86a7378328b43c00eb0bbd14e855116ddb2e1b51076
SSDEEP

1536:OqO/lp4vdMe+rfmhj8N8P8oBHPooPI2fKSx9X4ZWbpONiWG4vnUGUa+MP:0a1r+bmhKe5HgSIKKM4bNcsUGUaH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
852	AcroRd32.exe
852	AcroRd32.exe
852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ae644e06fd2fd90ce0feffae51a2a93c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d62ad988c0a90195f433ba0e5dc7bc92

SHA1
53be3c23324bb1cb1ded662438f83ac2f970251a

SHA256
05a2721c6b690061635474cf3890b9bcc801f58c536fde2b344eb04a05e7972c

SHA512
3678080b625ee80a94fd2add6c1b2a5b60e335a0ac8412fcae12ddc3618c71daf9d031f0c03a3a744ef975dddb42d951ff5c853305c7b9d3285f0027c04a5d03

Download Submit