7573da15a3638c25e5548bc8b27069729d7afe56d9fb05e85508c8f04f39c634

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

096ce5225add1548fe24203afd94a45d_JaffaCakes118.pdf
Size

77KB
MD5

096ce5225add1548fe24203afd94a45d
SHA1

4e669d28644f42bc3eb1bff9b1232b57565bac41
SHA256

7573da15a3638c25e5548bc8b27069729d7afe56d9fb05e85508c8f04f39c634
SHA512

4599b85c0a6d07985648d89831101bffb5a601848ad9d7df836fcfc18c0e0ac61dc4e776dd8c9ee11c01e8353979f00ad2e0c91e41e8da56026f02516be5e93b
SSDEEP

1536:QSnMXjmdVcpj+jILVH2PO+qcu42oH6ivfBFhwGjA4ZENlOaRWqhin:lfYJ+8LVWPfuafRzZENlOq8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2872	AcroRd32.exe
2872	AcroRd32.exe
2872	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\096ce5225add1548fe24203afd94a45d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4625735344f8c030dabfe33911a2ce10

SHA1
e9b1abc15727badcab3004a53a6c9d646cf486c3

SHA256
b7ba598fde2a2c20fcbf33fda19db983656a1a8080cd431d7c7133b6505b0241

SHA512
bfb9509c46dab72ef831c18abb6671d4df8c334ef49946a4aecb641ee809614ad24210225124ed09cdf7f9d9b6d5dadc426b8f2323e4e5e93d3e7e1fb7ee9f4e

Download Submit