6f0519f8dcaf6d59971d2138f43bc7c5a4adeae7bbe0ebbc64b11c50e6103701

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c17c76889601a516388b69b8716e27e4_JaffaCakes118.pdf
Size

77KB
MD5

c17c76889601a516388b69b8716e27e4
SHA1

0bff9e4c077dffc5145249daf4da691b0c68eab2
SHA256

6f0519f8dcaf6d59971d2138f43bc7c5a4adeae7bbe0ebbc64b11c50e6103701
SHA512

87f7adfb02214212e8148473b9fcc7fc84cbcb6dde87ab07e7f08c9326f716e43dda49d2ad828849219c16ec37553add206c61cbbcfdca975a11fe077d187b6f
SSDEEP

1536:BM3wG1qJMEVVNWxWZGKxfFupTyl5PUTbWmnDseuOGLsBFjNlrEmzRqoHXFZmGWSj:BuwuuBPAxMtFhl5PAUPONFjNqo3ysLf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1924	AcroRd32.exe
1924	AcroRd32.exe
1924	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c17c76889601a516388b69b8716e27e4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c9e4b369abb884517d2121fe9276f791

SHA1
62a46afcf86a9f3dbb68b2eb1ae697eccefe3e1f

SHA256
0a9bf57edc3833dda3f20694c71b3be65b21ab1b7a5a7fc9b8eb0ab84469b66c

SHA512
5035b4e2e900b0b62b6de74c034016eeda9c9a7f033bea9a6bbeb39cdc6373906fba436ac0582ae33147b7d719f9fd740f4a5ab92e1b029688f7bf3f368287b9

Download Submit