5ae8ad25223e7e936b6f31316e6affabddef5909b026798da60609c4274060e6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f70d21956755cc8ffce258c3a7118d00_JaffaCakes118.pdf
Size

72KB
MD5

f70d21956755cc8ffce258c3a7118d00
SHA1

6f6d68eb6f16af09374a5a48b56a7ff34effd1ef
SHA256

5ae8ad25223e7e936b6f31316e6affabddef5909b026798da60609c4274060e6
SHA512

8ceeec1476e551a3b916aa981fac5b93280a244b312b932d037f74cc02ac67cd638857f16887d6914284abbe9772c524c477807922f3cec629fbb3d203a494b9
SSDEEP

1536:ot+mxnlK+jWOkE4tKazP4vNS04y4ieXFQLKYT5Zkfz:dm1lEO/4Im0R4yAX0KYT/kL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f70d21956755cc8ffce258c3a7118d00_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
527a8b69786402dd001ac638fa3c03aa

SHA1
5dbe23157da41eae3ad5b9e32f87824284e1a6d6

SHA256
b9d41f2521fccb245c9de3cef56de0ca3da27afb3b1205debac5a0d7e11ab5b0

SHA512
5717028db23ec74dbd764ff3d49cffd7baf3e7c902d8da06c711c63d73000cedae2565731993e8a5b4d768029bacf7ef7c0e14811e15ce8b23cebc2941ba8a35

Download Submit