337c946d972a728477766b62c30ecaf696d69ec57e04755577b79e8cdeea13d0

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d586d6561ca863434eac83198ac10aad_JaffaCakes118.pdf
Size

31KB
MD5

d586d6561ca863434eac83198ac10aad
SHA1

e93d52573f3d3e1d84e8063d6d16243211f15dff
SHA256

337c946d972a728477766b62c30ecaf696d69ec57e04755577b79e8cdeea13d0
SHA512

1cfb0adf4648d813c2c880e8bd373fe0153bdee649e209a52d0da1a02b313707d3ee933dc80fede457c53d50219538256c836070735ae17ede76633511f42356
SSDEEP

768:vXuMZmwgCLWar7E5Hpx+y9yFHpbadmJHihE+Xz7tFydOr:vXFZmGWS0j+y9yFHpXJH8E+Xz7tF5r

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2960	AcroRd32.exe
2960	AcroRd32.exe
2960	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d586d6561ca863434eac83198ac10aad_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0eb617d756a421ff9ef552abe53c42c0

SHA1
674fb37e8b7ffb4d16f6348862fcb70dc0015826

SHA256
8c0a8a1b20979fd6fbe42036bf7335fe9c28f959ac8b8fd2a8ec4a782ea1ddb8

SHA512
32730d011584a3fb5efd8cf63343bada18f8f3a34d33edb6ff6363eea72ec22c238a0436834ad2c244151146b3f5f059b78e77b80b1774bbe5ed8520f61608f6

Download Submit