0707171207c7a9e80e1cc7b4b1cb23593968520053da9c857f9d2a41af92e93f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cff26145dbb93b40cac28fdb7b9900e0_JaffaCakes118.pdf
Size

52KB
MD5

cff26145dbb93b40cac28fdb7b9900e0
SHA1

e95e13d98f83e461dfc7e86f9689bb194b378fdc
SHA256

0707171207c7a9e80e1cc7b4b1cb23593968520053da9c857f9d2a41af92e93f
SHA512

4a0c200bb7a3cabfe55aaf4b678d2e6e037fd79ea411db825b082394256640665cb22f5126f4320a6dda937a285cfb0e49c07ba8c461d9dcb362c99e1ff1e769
SSDEEP

1536:hmMOsrEPRvJ1c7shO0Ne0M0IoIH0e9VQcnAiRmADdHZvGYLn63X/XFZmGWSp2:hmMB2VNhneP0IjLbrAiTpNX+3fysp2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cff26145dbb93b40cac28fdb7b9900e0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8705bcd2ef923eae99b26c89898c7cb6

SHA1
afe4a00ad93c254c4a6d61a75e3bdbc52dfc320f

SHA256
986d66dde2d7402ad65c031c824d185642dc17d8fc8813a8a658fcab60578a00

SHA512
b4d15b524c1cdbbf153aeecc359fb85e3d52d0166dfa99c8a50710546e7a8fa6f0a37c43d20a2841a511a045a5170eb62a49d801cfb4ef36e3137773ab4a3e5b

Download Submit