60c60741936b19c9c32bf2ffe5b8d5fd958681813768b1642c2789918276d642

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

efa29eed839a27006103474c70786efb_JaffaCakes118.pdf
Size

43KB
MD5

efa29eed839a27006103474c70786efb
SHA1

816edd4d9e74c5c52329bc2bc16c4a996aaf94f2
SHA256

60c60741936b19c9c32bf2ffe5b8d5fd958681813768b1642c2789918276d642
SHA512

65f89394599dc763aed2c566c5a8ee74e29d36bfd3a4ff32d1e15f1317d1309a8747b4414bdf53c7f41ab2fc043d556f3061eae30c896777f82fd3cf00113317
SSDEEP

768:v7xRKxQqPwLRVu2ixU+1NhJoPzZhwe1aPZVkGGmeunDQIaQFr2nJobc1Q/0L/ZIB:v1RaQquGOmN0PzT1aPZVkGGmeunDQIaY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe
3064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\efa29eed839a27006103474c70786efb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
97304215aa4189fb1b295e272babc7c4

SHA1
279b04cd1b253c6533d617477e50eea466eb8d95

SHA256
567abd251ea31746d58816b765c8e1e87ceeaf28613f090be01afd91c1123189

SHA512
a0a3d2358a1beafabc7e7b9111580fdb051cd765133f5f339713e6e71fe9c4e1bd892f5d7d6dff8e06754191bb3da54985043a9c840373eddc0a77166e50172c

Download Submit