6604d6e857e16c65e9fb8a71d16786a255fabea8b0809caeeaffa57973cb6984

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

071410060feeb1a9731c3f83e1bd3c8a_JaffaCakes118.pdf
Size

89KB
MD5

071410060feeb1a9731c3f83e1bd3c8a
SHA1

919f78e81d590dd81d7972cbfcd3537006220c5b
SHA256

6604d6e857e16c65e9fb8a71d16786a255fabea8b0809caeeaffa57973cb6984
SHA512

398452a2b7ef0c81e82ea5d79976af979019c3168a70f7b1de576c73fc5b2ef73943d16d6580341223768f4d2c7c15e77256cd99923be19f63ce6f638776c895
SSDEEP

1536:MUpbZinHigYG4K6OuFkq9i+hO86/vPoibXnUTQ7/E8KB+WaH6FOWPaUeiCizjCf4:CCVGwtri4K/vHz3R3WjHxzGonH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2204	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2204	AcroRd32.exe
2204	AcroRd32.exe
2204	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\071410060feeb1a9731c3f83e1bd3c8a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8f0f87b430950b4c122e55dfdde45e73

SHA1
56af1ba7cf23eaaf5ef24ef184b5f893143cfa95

SHA256
154c7fbffc67e99dd22710e83df4ca04020188ce1927962055f123365b32d5a3

SHA512
863741e596167f858730dca3906611b9ad572d5d361c38c2b02e4b35da7261967cdf1ea4146919f73e0051493576eff7474df5d36c8e810f7a8e5f21e257e843

Download Submit