27379e898ce3fa1e31089419462d924ffbf50062002084adaa1128687bde926a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16379e6397eb5a64ecdef0e2f9be7ec6_JaffaCakes118.pdf
Size

96KB
MD5

16379e6397eb5a64ecdef0e2f9be7ec6
SHA1

da99e2cc61f8af7cbc381be6088aa79e52e8cfc5
SHA256

27379e898ce3fa1e31089419462d924ffbf50062002084adaa1128687bde926a
SHA512

8aa74e848efb71d1639af2c171e60a85ae31142148b7c03d48e423eb9076eae723e1518143d1df0132edce257242882892f8611e9f4b5b17e00bc08b3d231ba4
SSDEEP

1536:UF3nhBLLoPTJthvNv75HYPkBCvUpPuxmxkAcyqoITgWkNpOPqKIrOH9WIri/W+qM:i3/LiTJj46oUpPuRs52Pq7rOH4WbmpZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe
2852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\16379e6397eb5a64ecdef0e2f9be7ec6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
35989d63748672ed771900de56dbc99f

SHA1
13913ed868ea5a142330410bba24a026cf65aa20

SHA256
add463f78c740375174d7898c6cdb5b5e148fbe6ed2e6b09a1503aba5faa4081

SHA512
0f128b6aaa38978e8c91c580142e982709f3af4476da4ed365ce5aef9d7f86875c6a769af7f789792fb5294b92a6fb30faab91fc57cad431ec5839a44648c2b5

Download Submit