0a7cc326167135baa36fbd5d090ca79db8069d70e3f52a0bde0b7537e296a099

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c076febd8a25c8701ecbce25cc4743fd_JaffaCakes118.pdf
Size

92KB
MD5

c076febd8a25c8701ecbce25cc4743fd
SHA1

4715453f9b9b181ea09f5e187321ff3c52f44269
SHA256

0a7cc326167135baa36fbd5d090ca79db8069d70e3f52a0bde0b7537e296a099
SHA512

0065d419739ae0f50879b87afd2e0922ef2a6bb3976eda93c43e6629510efb1269e68f83b76e66c3d0c1253370a323d4f1cd7d0ea02a6f90f9fbbc20ae7d53f8
SSDEEP

1536:yj8dtUzIAhy149D1Bmjz4HbK0CGqjCTeiSRWapOtQHWIK12PYLuiED:3/UzhhM4B1BNbK0PqWTeCtQDK12PYyP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1320	AcroRd32.exe
1320	AcroRd32.exe
1320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c076febd8a25c8701ecbce25cc4743fd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
020a3439352cb52d2af1305450f9dee6

SHA1
a24f58e46f980eeba28fd95218808748fd626ca6

SHA256
d5831a66f170fc2c913ca2204d67999d22e1340d557dd65b5f8544d4d443658b

SHA512
d9641d4189c33b393b55852fb1cfab1ccc51705312dee7a0420a55924810f86d81ef5c2621a030a1d8356744e40e92adac0dbaa930fe95b6ef14543aacb409fd

Download Submit