ebfcd507a73918ce208322237fc0826530b1707a8da4e11dda30f5a74a620702

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17071d31f4787298f213ab52c8a00d78_JaffaCakes118.pdf
Size

82KB
MD5

17071d31f4787298f213ab52c8a00d78
SHA1

9d0414da4a365be9f859d2939e2ed3ef9e3555ab
SHA256

ebfcd507a73918ce208322237fc0826530b1707a8da4e11dda30f5a74a620702
SHA512

15487b4c34fe05e3e06a071b3082a736ea6171119b53433cbc858ef9644c2bc51bb3ab86d7733ae5b187e5aa3146c8e36d49c3fa7959da8c6a97852ab15353c6
SSDEEP

1536:JiXkmJVPFCifMMifVy545jzxGhrNuWHpOvIjBwPSCN6WReqJJ9JDt:kxkOFiNr5xGhrIv+pCNj/J9L

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2028	AcroRd32.exe
2028	AcroRd32.exe
2028	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\17071d31f4787298f213ab52c8a00d78_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
98d18c5a5b0c849c4d54f0ca3a5545a7

SHA1
55a45829ca0ae02867a69f2cc64485443e8977bb

SHA256
b7226b3390d670735c739f6563686bf468e7fff7b6c03e97db3d647e3b9bdeaf

SHA512
1d4b8f2b32534fa9edb7601f59d9a8d87abc3234f759cece5fa2d13477ff5df901755a624a44b6cb2bdc7132ae65edd584b091bc8f9e7b83d3f60daecc827b20

Download Submit