76e12bbdc6eaa487d670fac9e97bf3b987e9f05df83658393eaf2963f83ebcb2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c78d6343bd6dfe8b19c20779aead2bc8_JaffaCakes118.pdf
Size

83KB
MD5

c78d6343bd6dfe8b19c20779aead2bc8
SHA1

5d07ad48f437f7485270ffdcc8b7df1adbd32371
SHA256

76e12bbdc6eaa487d670fac9e97bf3b987e9f05df83658393eaf2963f83ebcb2
SHA512

6a8ec0efcbfac01d77ac463df8177f1ace3a4ead1648ef794e3303281733a26e7e061d3dc3367c823b65a2654e4e9fa87a35ce1f7177ef5eaced3d2565aa442c
SSDEEP

1536:AZyqEEpXncr0qVB2TkZ6kNogAFFToWUWxApOGzWiuZW5bAZLv5ne+8:oCYXnNqVBEkcGvuFTL13GVuZW5bARM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2872	AcroRd32.exe
2872	AcroRd32.exe
2872	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c78d6343bd6dfe8b19c20779aead2bc8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
855db3434ed048109b8be129d24adc13

SHA1
1a7fa463e52ad46fbaff06e07d196718bf8b471c

SHA256
013add0eacbc1591a08e97181fe905577070ddbd1229bdee89118e402edb1be4

SHA512
e18fd9b6238d553709907d0cb80daeb260899d5793f286d15fe27f732831b8dd35a1c731011b0e860f0e89b344412dd40e72ddb34635d27efa0d93711e75e265

Download Submit