2ab7e280ab478c11069b930a2adcf1d33e44f59ffd0d3c147cf2061867a6f48c

Analysis

max time kernel
97s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1541959591d363ab4d33f0f54a2fa19_JaffaCakes118.pdf
Size

81KB
MD5

c1541959591d363ab4d33f0f54a2fa19
SHA1

714a40c25036d26c7d968356c85fa03e2ade0115
SHA256

2ab7e280ab478c11069b930a2adcf1d33e44f59ffd0d3c147cf2061867a6f48c
SHA512

fab79f29db283c231eaee52a6e6f88c0072a85d7d2bd6a3817888244cb17cb2325b038a884e9f470a33b00302678e71b06ccc46682206b831591548cf46effcb
SSDEEP

1536:S12esudNiPNms3zXaHU+ZYkNk2ww8zAYMgaWE/xRZWbpONiW5I3UHP23SBSlLz:+PXdNeRgukNk2wNzAYMyE/xRbNc3h

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c1541959591d363ab4d33f0f54a2fa19_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a74b20fe3cce36f105c4ae892493bc61

SHA1
605efed3b131375b9125f8fa1bcfdb38b7af5a60

SHA256
4ad87bf73fe21072921f3f8ab124056812983096f03fa5ddac4fc6d4bd407166

SHA512
0c819cd5d2a6b8f5beaf718d1f3e323bf3f59393d7f8e029d6d8ed489e6c17b2075dbec19f4270b5d32ce11468fe7f0ee352bb0e499e1dd0ac09b2477e75d91d

Download Submit