aa2515c2a8c6117ebbaf5ba9c9727ea391b80c10315fd4058c94cf91947beeb0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1346b1f4b27aae0467f23b99e3d99157_JaffaCakes118.pdf
Size

75KB
MD5

1346b1f4b27aae0467f23b99e3d99157
SHA1

d8fa4bc35f99ab46a41e66c66bb0b7e81f1d87c8
SHA256

aa2515c2a8c6117ebbaf5ba9c9727ea391b80c10315fd4058c94cf91947beeb0
SHA512

36273f14f05747aa907e3002311f47e6c957fc8f4438910a2e5286cf73160215b52a456a6eda33ec041867963bead303c6b02586c27cedda41629ad432b1be42
SSDEEP

1536:p0NdA0curG52CJzuIIBBRL6LNd8d3G8zDHzTw3xFHs8jRvxO:yzA0BG7JPkR6LKfoxFHs8jRA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1346b1f4b27aae0467f23b99e3d99157_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c5d11931c2ea69b336b51767f9baab45

SHA1
e7c350ed41ff772dcce99e152e00018716cab84a

SHA256
3bee89c25ace7f194fdecbe268f190053ef960db7f91193558180af0f74fcbe5

SHA512
f866c833669fe36f267c162cf3e71fba562b71b4d9bdb3c17b9646c41eb4b4e7e7e2facd8e3dd311c1a7c164d481dcf1b801212a9b5fbeaefcfb31c95e52f5fd

Download Submit