c7e3a4d609598e12ff55e385762ae2b4cd70ff368d06b04d97f000bba5ed78b0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

073ef52f06296fa74f122f3bcf13352b_JaffaCakes118.pdf
Size

80KB
MD5

073ef52f06296fa74f122f3bcf13352b
SHA1

90a49463cedd9400e00cf4ca2dc5e7b4dbaecbda
SHA256

c7e3a4d609598e12ff55e385762ae2b4cd70ff368d06b04d97f000bba5ed78b0
SHA512

8e1fd291e5cf3f1dfd3c91c048b5345aa74c4d7ead8009ae9fbb0cf8d3a424a3906ee2d43449ea2922fe4fb1cacd1ad2e3b8303b27a7d24bc7e29a1896dd4ef9
SSDEEP

1536:A72qXekcuhL6OXmfLkHYEnuZt542aDgE8lxhMhvqxynqieaPWw4qxeCDNa0Xl6RL:sXekcuhL6OgLxEnur542qP8nhWnqrWWP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2204	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2204	AcroRd32.exe
2204	AcroRd32.exe
2204	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\073ef52f06296fa74f122f3bcf13352b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7d969dcc52b3d95769d27bbbfc9fee36

SHA1
7177b8776b24d51cc62d053722a60012c7d6a076

SHA256
015b66a0ca4b36b4722acf42af41fd389562fa4374401eea31cfd3093dcab7e8

SHA512
b3816b0988baf89b65a725cc20f000da5087024e920a96d67d758bdede88af9368647e12fba7ea2a77b1dda293bd7b119074ef56379c7521c67408e4b043ac53

Download Submit