6347b4b9423f6fd647a57e0aa6a1383358447cfe11a8367de94288c6c50d87f2

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 15:42 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c91eb234746db9e19597e59941366ab9_JaffaCakes118.pdf
Size

68KB
MD5

c91eb234746db9e19597e59941366ab9
SHA1

b01378bb1d05c3861c286cdf6b596989921e8e57
SHA256

6347b4b9423f6fd647a57e0aa6a1383358447cfe11a8367de94288c6c50d87f2
SHA512

b8a6ba5a080fbd02ab406cec48915df7c4852c1c330c77cf5f24b9c8265b963f2dd5ac1e2c36eec2bd0c42986e5e37b18ff166b0209df243a1f40965d961d8ce
SSDEEP

1536:T+3pjGjmAQ7xBAvtQYAlncWomAaTGDpaILYZCAuOQUamzLt9bIPEPb:Tq6SNGLA5cW60Cut9UP2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
556	AcroRd32.exe
556	AcroRd32.exe
556	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c91eb234746db9e19597e59941366ab9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e885861386ab6182d2b000d8b02ff21e

SHA1
7b4c7985fbec541e8615cb9e0434742f791a8e66

SHA256
01b6ed57d31d55a9bac323487d82c39acdfa40f17a993575d94a8f534609a83a

SHA512
c621230618f934c387621410b544ce0906c954d8609804b3761b178fcddb968f3807ef1157cee570d7d404d39caff02982e307c7cd88b93b0973b8232a84743f

Download Submit