562f4637c4373992f2fb28bf4a274371e37d50bde85725571cf6d2857ace3b81

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c09a164732ace2c47fa1b48f217033ce_JaffaCakes118.pdf
Size

88KB
MD5

c09a164732ace2c47fa1b48f217033ce
SHA1

e7b274808122fa6bae521a4bd2a3d4fb515beb49
SHA256

562f4637c4373992f2fb28bf4a274371e37d50bde85725571cf6d2857ace3b81
SHA512

91ead40ff6904f54ccc9eacd631b008d991281801218dd36a4f97c1fa3c730d5fc1ece2f22c62a7afed28ab4895223c7d0a326350c852573f135b2ebf0f34436
SSDEEP

1536:Csif1cGh/+Y9EXL8ARLqKHLdhrhr8jzFKSU9zvaIIsWOpOZyWm+0OJ1FtBWHcltP:wf1cGv8L1qKHLdhr1sMSZZQIbtCclp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c09a164732ace2c47fa1b48f217033ce_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6d3a7d2a2cfba525d3970329e4e0c3ae

SHA1
1d7590a2800b218353690bfbb6b87f23340beb9a

SHA256
4f830d135d3305aed00238fb7c8e43718ec0922cc55c5f1782f4d5cee07def55

SHA512
98484514543bee8cfe1d4147ea96cbfadc0e3481c444b7d2cc1498d8687f0d9c711cd7959bdf0338df67a837dd9225593e6352a0951fc2049175bf0269441efc

Download Submit