6553a29603eb37b6b0bfdaf7de5e0495313a4864030c9982826fade1f0f69942

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1532f12b9eb9d6ce964dbd2bfbd013a9_JaffaCakes118.pdf
Size

92KB
MD5

1532f12b9eb9d6ce964dbd2bfbd013a9
SHA1

4d5c01013aae77088bdfac488db340efcd3fa63a
SHA256

6553a29603eb37b6b0bfdaf7de5e0495313a4864030c9982826fade1f0f69942
SHA512

e6cb782d255d776f9d215d3f083608308ebdb02e0c17fe1c00811291aad50c92540dedbde874f977352f22625eea70ed1340cf8b86f48162863fa18d98b0cf30
SSDEEP

1536:F6E+kQy3JyrUqdKRlI1DhFkZyzfsq0gqYodtm9K6yvwMTWHpOvTWXHxm76r3Zj8F:D+9EJyoqd+lsDhBfsq0gnodtm9KuMxvz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
796	AcroRd32.exe
796	AcroRd32.exe
796	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1532f12b9eb9d6ce964dbd2bfbd013a9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7bf9f467354e7eaf15cdf8394672d6bd

SHA1
090facc8115a4a5343b2c92b91aa3db95501f034

SHA256
c2cf918c918a87c22574771883db707d22838d5aac5de7ba3be3358c7bc6774f

SHA512
1221ee6830a748ec2584fbc01242a272419c4ab4cd94c068397c7abebf23e6c7ea419406ee3d3ca81046a9b075d84579f56243d9231637c697ef6ea91f145ac7

Download Submit