6bb23fd4f772be3b8fddb923c0abf14438d166d4fc359b28c1153b819e5ee938

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00237a4279a0558b0c3da787b0f2c386_JaffaCakes118.pdf
Size

76KB
MD5

00237a4279a0558b0c3da787b0f2c386
SHA1

c13f59b9295d8509c604bb6752ffe40c42167ba1
SHA256

6bb23fd4f772be3b8fddb923c0abf14438d166d4fc359b28c1153b819e5ee938
SHA512

e4b338b65a69eb02bd6e072f6287f74710f8c4dd8df839b51ba474c2160c249081b2541a2bf81acde77bc8803180127a8993dfe61e595a8e4ade5c8d24d24ff9
SSDEEP

1536:Q7rP9FMGhZy6lsrUEj3lF6zuYxzFryybwoBQ2IBkYSMzrjCUbH4wS/Pi:AFMiEpjVFKuYn3Ty28kQHjCUbH4wSy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2688	AcroRd32.exe
2688	AcroRd32.exe
2688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\00237a4279a0558b0c3da787b0f2c386_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
43f70572171420d7d50b2be6fdd196f2

SHA1
de5e59fba3b388b24f0a1d0bd6060540a51a2bbf

SHA256
3478299afb6f58c036149fa0acdfa308b276a73d795064161eeffe00618c7178

SHA512
a3f00a32509014e2582818660d05958b0b780368cfd91f732713303c96ae4d7dc114e16db39ed03143cc4e3587693b69632b40869c7db2b6dd9f2dd508ffba83

Download Submit