7c46aa912652835ea87c3c0bfa7c9abf95eb0fb5fcc9c61cba48332ff36a234d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f9b81501a036a6913add13be2551d54f_JaffaCakes118.pdf
Size

79KB
MD5

f9b81501a036a6913add13be2551d54f
SHA1

bf5236bde75652dd85bb3ef860ffd87d81da0ba3
SHA256

7c46aa912652835ea87c3c0bfa7c9abf95eb0fb5fcc9c61cba48332ff36a234d
SHA512

366b3c6ef9f50fb860cec2481deab93aecb92c06e9b6ab8d6902440133a56998a6c94e97f0138c3d82501e1ee20188dc79c8a16be4ad937c866c142a82cebb79
SSDEEP

1536:ygPI/WqXy/0WFaQ3YsSzvwGw/3ZEGMbjxLAYlMTxORCIWLPIqzK8vEWwpOSrw7:7AJy3fSTSfMvy1gRC7wmKojSQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2212	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2212	AcroRd32.exe
2212	AcroRd32.exe
2212	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f9b81501a036a6913add13be2551d54f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a1c03df971f86708f1450a781dbbfcf9

SHA1
a9c2375d36bd7112ddd1a88202074de6df191e2c

SHA256
ad4d83d9efebd537917bb42be89ef6b4c2958584bc5acf3ec16be3d37d52bfaf

SHA512
68fa8d4ad2ef61fa5e0a5fc22a66146198dbb6946f31db60d618f208580be46180ebc02e6ea06025e286f572b50c78ab2f9598e86586d60ed95f4d3f69d1adf7

Download Submit