cc871957a3d0af6e2b3ed70cec48525ad65f2f66a3303f5df37e612cdafd8f21

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8978fe8f111bda0827a60c94dab9503_JaffaCakes118.pdf
Size

50KB
MD5

c8978fe8f111bda0827a60c94dab9503
SHA1

3ef04727b9804a2a3c7f4e44939c4ecc4aea6574
SHA256

cc871957a3d0af6e2b3ed70cec48525ad65f2f66a3303f5df37e612cdafd8f21
SHA512

96c71e15882865db00287ea9444db71dfe93e060d40f90cd0b853d08bbd8fc46ac82c3c26aa2d12f4db85dbaf844a049584153e02824a8bbbff61552f22ef0fe
SSDEEP

768:20gGzpDAY3le/erD8Ym1NIZCoPg0CdHcGG1Qa5xDHvDlMEBFGApI3DTtrWER:mGFMJcBCd891QafxBFXYNrWER

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe
2852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c8978fe8f111bda0827a60c94dab9503_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
732f7b60e60308a6e863e9dfb1978ddb

SHA1
408f82529367a8634153747c4e3c168bf196103d

SHA256
323c1120f9d1d86e741e98792e4d6a5dc84ec9f7a37d9d5df0a9c6d7025426ae

SHA512
e413cb97fee67c1ead4a2b6a7aceaf8533681065dfbfe0b48526f18b5366df3117011dd1fe7357bff657cd0aa5396c4942eb94cfb953b0b94a0bd2de4f3f5981

Download Submit