71f6a6cb800c7ce4327357c7039a94052a7db9b123e761f699f3b87e2ab755d3

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf7729f16830a4c58b5d717bc067fa75_JaffaCakes118.pdf
Size

92KB
MD5

cf7729f16830a4c58b5d717bc067fa75
SHA1

5124b6d2710d24ffc40456f1f161b84f5036d2ff
SHA256

71f6a6cb800c7ce4327357c7039a94052a7db9b123e761f699f3b87e2ab755d3
SHA512

8387e83341db8e87dd90051f6dd506c21bcb96c445a45f963c295ea4d903068dc32e5ddad7584d2076adbfce18589d2d19c6e7d4639489bc18ac235bf91ef2f0
SSDEEP

1536:pGFmFtj4GON4LMI2GqkiteLF6VOWRCloeojZ5p1V6yJbT:8FmQGON71HtedPloe0PyyV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cf7729f16830a4c58b5d717bc067fa75_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1b973e58b13d3a5a39ed15480a353648

SHA1
46f5904107db671af84a44e7886424576e29f205

SHA256
74832492a4a35ec78e0911d66c94f668ecd497aa2979aa12a69ac5c53cd5c75d

SHA512
19fb179af7475832244d9ceaed09e14f147dcc2ac9daba49cb20c697063bbf96220fde61dce043b9e46343b2f25699291040d59a4fc00ec1fe49204938d91cd0

Download Submit