897cc37c1edff667f4bb982fc74d460dc6bbb63e8391a88fe03ba3ab795572a2

Analysis

max time kernel
105s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1671ba050c7b03a30f63ad8885bd580a_JaffaCakes118.pdf
Size

83KB
MD5

1671ba050c7b03a30f63ad8885bd580a
SHA1

2065e4c57750393bd87e8529e457a90836fcba60
SHA256

897cc37c1edff667f4bb982fc74d460dc6bbb63e8391a88fe03ba3ab795572a2
SHA512

8012f8f39e7c7b353dcf14b848828bb454e665cea1908fe567818e381d624563ade99921cb964eb586a3dd351c6900bb443ce0c5d34b9ce04fcb8cf32f117a4c
SSDEEP

1536:tJ+oRMN2OrNVmRXQzRTT5Rm8+mJZIfteXm1vb801FtUvUL5zlLRDP05iWf+kYv:X+oYB2RU5T/m4I1eXmJntUvUlzBK5LW/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1640	AcroRd32.exe
1640	AcroRd32.exe
1640	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1671ba050c7b03a30f63ad8885bd580a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
506e28d9541b1eaeaa7ef97531cde82b

SHA1
e11eb9e0628c78d7c3aeaf9203d1abc8d6a74af6

SHA256
9ba820ffce8c3d928bd095f0408824613d93da0de6b23a3e9ef851a96f77f850

SHA512
a9efb0043aee0edfff916297df266077ac6b0b0fce0c851d721a2529598094dcc12283a44d7991c0bed7349845ef2456c1880a27d5aad7b8efb95eadac8996e0

Download Submit