ec41f9c4229f389ea30c5f48289339c6d5d4d7717c13db7ef0c136befd8c8edc

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8c30b99489c4fd83c56932cb5974cd4_JaffaCakes118.pdf
Size

37KB
MD5

c8c30b99489c4fd83c56932cb5974cd4
SHA1

304a0198351612bf6a0b44de9c0cc23d2e67c02a
SHA256

ec41f9c4229f389ea30c5f48289339c6d5d4d7717c13db7ef0c136befd8c8edc
SHA512

eefc7a724d32b37207407fff9c14cbb15a236f7064bb66c02faaf13e8bac246d0efff073d72e9e44fa7c651d12139adfa66521208704223200b44f57ab3f489c
SSDEEP

768:ggGzpD02lJ7EDtnbqrnbLd8tQGkJhqOgY0VGKrvOc7XiUnoa1s2nwdTT/7i:tGFIKH30lrvOcjJocwdTT/7i

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe
2668	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c8c30b99489c4fd83c56932cb5974cd4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fcfed00578b3137c2d5a005e37f2b74e

SHA1
9ecef06841edd96c04b9dd944f966a6d82ac2418

SHA256
aea8925e059c1c579c97d4d86e12f41b947fe227c60650779f0d653a2465d39d

SHA512
3aafc350f1f798521e8bca8768862d05556e7712f61db9257052f9b0826e32c8751493cc695b1cf2cbe8ef772b39b21a12404cbac666e66416a9e6a71ea9a316

Download Submit