41a002268d17a264b78174f5ec122467e2c433b5d56a19c90fbf08ecc8bed255

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17171613d6b78bd6ac4988b977c9c7fb_JaffaCakes118.pdf
Size

69KB
MD5

17171613d6b78bd6ac4988b977c9c7fb
SHA1

8509035938ad6c538e8d32398de4219455e9207a
SHA256

41a002268d17a264b78174f5ec122467e2c433b5d56a19c90fbf08ecc8bed255
SHA512

41d905e1f412a915ae2f511ac3947bbb71d81b1ce4e22386f64a30552c4346cb7783e8ec0e4d59259c28b39d90e15505c2d4ca206a5d45163e1b15adce50672f
SSDEEP

1536:X47v7vEztqA9+MlL977Cgxq13UDf6uJpRt+1bt9j6GPgt:I7j8nj97Zxq13UDSCt+1bt0Ga

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe
2660	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\17171613d6b78bd6ac4988b977c9c7fb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
de15a9c0148962ed4e87b58716e26aa4

SHA1
cac3f01946c14b0a1f7ed2f54493648414ac2d4a

SHA256
337abaf4438a1b9df7d44111c58886fdc7339a676aac73a50a6f34da98e1bc5c

SHA512
de43dda4440100c9356e1f630484224024ee4e98823448ff9d7bb504b691af0ea945fcc35c3edc1aaf63f1d7f96b3b7fbfab31af3d2529c076cea591ce77e4a3

Download Submit