97ec29614a5d5139d508f8fdcde57cacfad83ce1f0834cb5ba3061a17543f759

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d276aa60763c07acb66ffa7e72ce6369_JaffaCakes118.pdf
Size

80KB
MD5

d276aa60763c07acb66ffa7e72ce6369
SHA1

f37c6cd764445a2ab1cf1f41e84a6ad5271b1cab
SHA256

97ec29614a5d5139d508f8fdcde57cacfad83ce1f0834cb5ba3061a17543f759
SHA512

a7e10383c43ed36a06d79acc17b3bfd17ff5f9420511022ed0262be6207f5d94cf5a9a0136acfb540df279f2addcb1ef74b7fb2073d90048ab346738e30fd6bb
SSDEEP

1536:ui6m3WGA/4DfT8dkqxQkSxzHPYhTXsOGCBD9WcHaq3eMuy6GSxTmLWApO613F:r6iWGA/4DfekqxQkSpHAhTXmCBDpuMuC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe
2556	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d276aa60763c07acb66ffa7e72ce6369_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a0b4ea9d574bc8cccabde68855996fcb

SHA1
26ae3c45e4ebc49689dc956301960641a404b5e6

SHA256
929a4a6afd6765931559ca2f255e73bb6dec568c697840fa875184eaa230cf37

SHA512
76390d6ba4cb17475f7971bc07abfb9c217d16a6798bfec7c3d890d57d235b8ddacb98d2762b967c015916d08965214e1c1b6a6abef17e143b677421f176acfa

Download Submit