b05be3ae4427a671c186768a11dc8e25ebc1440c863dfae51e30beaa7c0dd62c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

177a21cfbb27fe24bac0dad4b0483e3b_JaffaCakes118.pdf
Size

87KB
MD5

177a21cfbb27fe24bac0dad4b0483e3b
SHA1

037bcdb53fd00ee9949e83a0872684cdced14e62
SHA256

b05be3ae4427a671c186768a11dc8e25ebc1440c863dfae51e30beaa7c0dd62c
SHA512

bbfaba3582c17c9f03f583b46415386ab901600e8f25705ec9e1fd68f529489ff343a8131dad41ac1bbb806cc8df023777d0494a78aa5acc78e7d0be557e54c7
SSDEEP

1536:qJHolz6ttKelNWrvwzl4C1g2FWXqeGKtcktmoje0Ts7WOpOaZF7CuTmBW8kiHgea:qFSz6tt/NWDwzyMgsLeGKtcMmZ0Tssah

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\177a21cfbb27fe24bac0dad4b0483e3b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9a4fc3eef288d8f6118f392dfd83b171

SHA1
9a2bd90680ad4339b9d5bce74c9c4035b6ea87dd

SHA256
236b77ac5476152f9c8abad3f9a8f15e7bac4f16e4c61bdc4546a29f65487ec6

SHA512
a349c08055ea7c242cbe8f6cb4163c1aa1122f7dd32aea6a249be79eb9ff3ad4f98f0d222562fcab66eab83a6c43f335c1ccac57d4f0f2efd9b4058bf6f1af81

Download Submit