9b66fee9ffd9a9856b53124308e6967e1aeb0148e40300c6a841726ede41ddd4

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f088f6d82ef778b8ad769057d0aade97_JaffaCakes118.pdf
Size

93KB
MD5

f088f6d82ef778b8ad769057d0aade97
SHA1

ae71e97ed8cf5f44af3d98ab2519e881efbd2447
SHA256

9b66fee9ffd9a9856b53124308e6967e1aeb0148e40300c6a841726ede41ddd4
SHA512

97115368a8eaa5e447f8497e5d06c029bad8706e31bc301efd7cd506cc278b2bf5353837d2da3a5cf0caab4d23480aa290003185481983acec5957c1e04a76da
SSDEEP

1536:RZlizCd1HREX7o8RioCK8XCCEcZgovzOtsOE+JHqtpzW6pOu26Wlypgtay/aW:qCby7/CK8XCCRKOzOtsl+JKtp4u23ypU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2896	AcroRd32.exe
2896	AcroRd32.exe
2896	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f088f6d82ef778b8ad769057d0aade97_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3a8040921fcc557750f2bfd2be715027

SHA1
b442a4586f6f8c3eb7fb7f614f8c65ff01d8456b

SHA256
3143eac0fcea87c1ef1a18f1597bdab37cad59515845fb25ab2144f7be131188

SHA512
7bf824a8a6c9a6793cd7a77bcb31d06ce36300e863c499b3e74af8a7c7a4bed37013338b62187971577af0f872f40b2c5981f4adc72c9d1e56c3ba8af84ff9a4

Download Submit