7cc7fa0c4cbdc7d190a869f8ab338f8ed062aded74b3df867e3a4b091f2f6523

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf10a8e08269576beabe6f783baeda0e_JaffaCakes118.pdf
Size

84KB
MD5

cf10a8e08269576beabe6f783baeda0e
SHA1

bc90ea305d4b86d7800a90cdebd8c4ccf07e4bd3
SHA256

7cc7fa0c4cbdc7d190a869f8ab338f8ed062aded74b3df867e3a4b091f2f6523
SHA512

f7962f3b14968777779d7d5665bf3be02c5869f6cca2ea54c4548961a1a1b5b22e055e10d706224da83016c9d1877d6ae7037979bbdf7c06eeb930be995d996d
SSDEEP

1536:gXtUpo9zf/hnPJQOYjn8VXA8UGCCwtjUrdjwmy6tvmWspORGW4aOHO0kzDTKD:CtU8z/hnwjcXAzC8jUr5wsvZRUO7W

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe
2724	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cf10a8e08269576beabe6f783baeda0e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8999c5b432bc09d0c1b929191de58038

SHA1
b867f64a47a7ce279874ccc76501fac9de9d7222

SHA256
be81aa2381f7a000d156b368feb2aab820570cbb549cff7966a66e41d98ff026

SHA512
69e9d839beff2b16c147fa1114212bfd5ab11af744c3c111959de5e971e60f5281fb530b0f8791907ed4bd8eb5ee6f2e7e5427568398b7562a4002d1eccab773

Download Submit