6eec07adbec4fde8a28ed93241cc12576a29a7bc973304d9018f212ed2a6acf9

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bab225fc491d33851b849e3b4c10a47b_JaffaCakes118.pdf
Size

78KB
MD5

bab225fc491d33851b849e3b4c10a47b
SHA1

e539bc9ad1cabb2575e3e1af4f01f1011338fe38
SHA256

6eec07adbec4fde8a28ed93241cc12576a29a7bc973304d9018f212ed2a6acf9
SHA512

cad0bbb5801833dd87d5a9d705317a7970f21bb612c05b8d07df3f6f457457d1519d20794703653e7042237323d0094db1f38c640888f3557c1e6859be3eaed2
SSDEEP

1536:DG/7pmkuA9HVrpfOjDHFyKJi885qdb/mWluSvWWW6JKO4tWApO684g:Gk8Hno0885ALi7WWdk6S

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2024	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2024	AcroRd32.exe
2024	AcroRd32.exe
2024	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bab225fc491d33851b849e3b4c10a47b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
429e1425cc5bacde4800ec6b74b6b40f

SHA1
7d8e31e1f96c1fd1791fb1737502d5a9efb93414

SHA256
8fa96cb006bf3c6c73abd6503e13064ef76f2c0adba074c7cbef17ab76739814

SHA512
e04096aa771595dbb8446f39640cbc182bb6ee841692fc8483d2fd1d0c9baeaca413e2b0755527f25a3f40e4e824e735d70660c68f64568c5afcb755b575d1fd

Download Submit