0c7b508a52fa27724c51aae7b7b4a5f1ba8d1e1be26a3c2911ef96d07df91b06

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

131ec409614998b3111f8571a778847f_JaffaCakes118.pdf
Size

72KB
MD5

131ec409614998b3111f8571a778847f
SHA1

b04d0ada86080b2e096afdfb70250c05020f9163
SHA256

0c7b508a52fa27724c51aae7b7b4a5f1ba8d1e1be26a3c2911ef96d07df91b06
SHA512

16abe9b939004167123e398588847c8ab8578358b422908bce5430882bcf90e58854d1e8bc4cb1b93004ce90cd52fa0d14a57d329cfa843c311651c875e8382c
SSDEEP

1536:vgErNJfQN9VhsdptL9kyD4pvQvm2vlFlDHtA4LoNeua1fpNsPjWlKZIE:YEN+NhEJOa4pgvlHDNE1a1nuWlJE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1756	AcroRd32.exe
1756	AcroRd32.exe
1756	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\131ec409614998b3111f8571a778847f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d30e5b126167a521b9e150812ac4cbb

SHA1
2ee51dcad18860b925ed8ef35fa2160254451885

SHA256
69e368d4fe07b0676e0ab83a8217fa2da696d12f228d075b8336f03aa6e7ed28

SHA512
c19ae5908943f37af4d8083ed40d138935c9322deed7bc1bc8ca371fff28a85d4068273243ffa2388277ee1ca99515a0191dd5c5556d990546b243f76bf287c4

Download Submit