0ffc413e4f7b7047d8b9edd05abf05c95f79bf92498ade99d0694e30674ee2d1

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b17e001e855e886673b3157ac3e4531e_JaffaCakes118.pdf
Size

94KB
MD5

b17e001e855e886673b3157ac3e4531e
SHA1

c158fced4eb1d67c346a00c845d6cb8104dddc1d
SHA256

0ffc413e4f7b7047d8b9edd05abf05c95f79bf92498ade99d0694e30674ee2d1
SHA512

78cd88d2ac33681bf42def7873b6d6c5a6c280e117dc7baae52cde3e535e5ff8c5557cc056c5145b2e05e18ca4cefe697e3bb975f0d5e83e2ca837a10e71e560
SSDEEP

1536:0yQz9XU7HPw+wLmoiaMUj7FU75aujzQMBCtOgYOYkNHbarqpgQWYkegFCEnUfVOe:qRkzoPLmoi/UjBU702zQPWTWgQk/4Z9h

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1360	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1360	AcroRd32.exe
1360	AcroRd32.exe
1360	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b17e001e855e886673b3157ac3e4531e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7cf5e2ca92a4521af3fc7f85ec74ceaf

SHA1
734964d281040fa2eb631b85f957dc99a68dd498

SHA256
703e09b4776c34f5dbe803adc0424061f02961ac3c1ecbcd4b9ba077dab147f2

SHA512
06a7ffbab447216491e9c9c43753e47cf74db4efe016dbb1c51756461debdc1e8e3e0d63964593c139118b417a60eae2cab66dfb18c7fe2f43860d058375586d

Download Submit