1cc9e8da4fcf89b3bc8895bb0e46aa21740d75dd854c601a2d40104649701f1d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7e4e22760ce12791816b042537beff3_JaffaCakes118.pdf
Size

80KB
MD5

c7e4e22760ce12791816b042537beff3
SHA1

eb5c6b3ce4ef1acb097c333578f2115b7d09456d
SHA256

1cc9e8da4fcf89b3bc8895bb0e46aa21740d75dd854c601a2d40104649701f1d
SHA512

993db4b310c85c7d9d2933e5079213ab9a4f2e88435a792b8fc8ecfc226a9ff21f99b547f19594f239aa2d67eb1ef1d65418cfcc0578b1164a2e05946c4c0405
SSDEEP

1536:3GFqeSPXen0JX0Bz+pdp4Y3KjCjnBEy8D6784m0eSOt8x:WFqeOXs0mBY4YajC7Bau784OHY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
756	AcroRd32.exe
756	AcroRd32.exe
756	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c7e4e22760ce12791816b042537beff3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1247cc4c0067efe42e4b9716bcd3a97a

SHA1
965591ed65c36348c20318c58d6af176e2538657

SHA256
2e9644cbd14c707efd57ceb1403a171f862c8c93bd0269f39b28ccd4c0345008

SHA512
d47d6adde831df6bbea2386f1e982ac31ea7d8b00aab63e69ff6e816c7fc6ec310d107df1bfb71a4be7fa4282f601c90500652dfc5eeebae080fb2cbd1b401e1

Download Submit