72078477bd3522af5bb4beb70eb753f6a8877a088fa87520d00ec7cde4994b19

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00b779d74256c3186f29b2443829eb1b_JaffaCakes118.pdf
Size

69KB
MD5

00b779d74256c3186f29b2443829eb1b
SHA1

12cbb868f73254f0b3981164ba9284f9dbc37655
SHA256

72078477bd3522af5bb4beb70eb753f6a8877a088fa87520d00ec7cde4994b19
SHA512

548d58b05366cbddda14fc74f8fce38fdd2c0d10594aa3183413a17bd57ccc637539189819f7f88c9132364a2e03e81f4d20bd506dc833962f8eeb73e568de22
SSDEEP

1536:Ih2uAS40l5H0zGk/LA3nn6I/P7ayfO2hA9I8dQNewfvWI07gN:svxiv/LAX6wP7Pm2hWKNB2ty

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1800	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1800	AcroRd32.exe
1800	AcroRd32.exe
1800	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\00b779d74256c3186f29b2443829eb1b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4e9c1190fbf757d1414f9f887a949927

SHA1
5232783c013656507bd20df29ca462079055f8f6

SHA256
8fab18fa88508f940359e8b891ef98f9ac85c04f8529eb9795a2a717feb98253

SHA512
13564d7c70f362e62f228ec6e4c98e22614f2b74039c56fd2798e744d23df540a49e24bc778e84e180473130449ed924c4358fcfd3fddc04f351fe9abc8fa796

Download Submit