cf37bbe56868839bcfa12fb0d10b5d18c64b4522f44bc8a07b80391296fb4b2d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d386e7c1312b2e6336dd2f0dc6a003a8_JaffaCakes118.pdf
Size

21KB
MD5

d386e7c1312b2e6336dd2f0dc6a003a8
SHA1

80eade7ba1a1c623909d3fad1e5bb05c7ff6b217
SHA256

cf37bbe56868839bcfa12fb0d10b5d18c64b4522f44bc8a07b80391296fb4b2d
SHA512

697a7e3714c1bd950db64bdcd88c0a715765f09b599486f4a017b6a4a4ac5e0f04a6a379f0f21cbb87cb8eaec9cf0a711e1f9c6efbcaafec6b21d7333bba2cd1
SSDEEP

384:VzrPbpLVlz1qtLBnR0qobGSbO7bS5pFi5pF8J0ECgxRdsTHA+rS/WY93Q4WnLOsS:VzhLVlz1QLBRfobGSbO7bSnFinF8J0EX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d386e7c1312b2e6336dd2f0dc6a003a8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7aa6ca2b6a67dd8dbf3858d4dcb4350f

SHA1
1db273d17cf06ba2296a7f9dea74d4289d878470

SHA256
af43839c122bf11c42a66a894174a0ce93d4d57e1529b6b908e2c416e804189a

SHA512
5c64a92d014d1cdafae46b93b30c59796ee0def26e801655db5d6ed49bf67c01f9b3560b7a4c58e637fa6c927a417fb5b7816ba3a156dd194f6674cc5738222f

Download Submit