a6cc8f2eb7661bd43f2099c61587109685d49a49caebbeda4f9257dad83f7c6b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c148636248c5e8767c83e78a46947290_JaffaCakes118.pdf
Size

41KB
MD5

c148636248c5e8767c83e78a46947290
SHA1

7b42185870970e289f16516d003ff057df7ea88d
SHA256

a6cc8f2eb7661bd43f2099c61587109685d49a49caebbeda4f9257dad83f7c6b
SHA512

68666e24a0751fab02991473784a6698c6a92ac06195d73ada0c05f25986845b43b83b822d31d3d14cf162643507d08c823085d63a63ef6d6da0ca83225dd974
SSDEEP

768:pfNkJsDrJl3dnMPZLyz5BIKno/zl/a+D2KJTb51U/kL6ZdnFxWnEcLKE5lXuMZmR:pfNcsnJltnMPy5BIgIzl/aU2KJTb51UP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2172	AcroRd32.exe
2172	AcroRd32.exe
2172	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c148636248c5e8767c83e78a46947290_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
93fcfc987b65b912cb19340dfaf47d5e

SHA1
de73a4d33e11836b806eb846f988d78a3681d0b1

SHA256
6b7ab4c663ca8920b97906bf53d004fb76774415233013c0427012c049e93e71

SHA512
9ff7f9d226f68925ebcf9ac8ab4d39a0b7ba8f2e9cd89df8071fd36ef897df8159ca4940c9663b9e2ca33d265e1c63eb61b7cf618ecbece63a5e351b29509e67

Download Submit