25375912df66273022cc819aba128e8c11e2addab06dff0021b97ea3ee52bf87

Analysis

max time kernel
94s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f646e47f6f3e99a78534f1d52f305a_JaffaCakes118.pdf
Size

78KB
MD5

c7f646e47f6f3e99a78534f1d52f305a
SHA1

c5546d9d00a363d880bb14d4d67e8dca072579b3
SHA256

25375912df66273022cc819aba128e8c11e2addab06dff0021b97ea3ee52bf87
SHA512

d91c6889e446792a0cd756e15ced2c9e0a125ab804a1f48983610afb316d3b913f83c66fcd68017901bb19c14a48647650cd68e4f8d52f0e9e85469d18345cf6
SSDEEP

1536:N08EUL2sYo+iI1xLii5tV0+b1jxALmWLnSzuubWOpOaZZG0gPx9j:v2shLwR5tV/bT3PMaZZG0cz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
628	AcroRd32.exe
628	AcroRd32.exe
628	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c7f646e47f6f3e99a78534f1d52f305a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4121318891773ec896a6de2096bd3e3c

SHA1
ed9282151188ca38d0094c7bcbeae4d5ab37b900

SHA256
5f82842b842332ca71e4ae72c34e69a01026ec3363f4ca96575ea329e0dcd59d

SHA512
b2ff136ab24415519c7363c41f7f597bee82037420f2d2a7b9833205edda034eaec45e5c5cca29e9aecb3f277dd07feee8f9e26f757c54c50e5138313d4562e4

Download Submit