7b4bf11b29f8812796aa472c919c07d54b93e7797661a4bbac02f133fd7834e0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17e97f04e564ab3afc3110855c84cfda_JaffaCakes118.pdf
Size

93KB
MD5

17e97f04e564ab3afc3110855c84cfda
SHA1

d88f37a5c4042ea050f428eec70c1317e9e6e4f0
SHA256

7b4bf11b29f8812796aa472c919c07d54b93e7797661a4bbac02f133fd7834e0
SHA512

521b5804902b1475440d143435a51fabe58391a85871813419b5d08e86f18a715e256631ddc39cd0a16586a314158b3a045097333f464b2ee1470cb2e3ef9533
SSDEEP

1536:2odIdU/b80uBJQc+sbm8HEAlN4EcbJdKIkWkNpOPMkFfwWspldl9pq:p8UDuHQc+P8HLLQJlZPrf0u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	AcroRd32.exe
2380	AcroRd32.exe
2380	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\17e97f04e564ab3afc3110855c84cfda_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
20058137c8d2b8b02f2b3810b188b400

SHA1
a55f830b2fa2362b422aaca1bcaa770b41714f67

SHA256
5194316f23bee944fa9accabe87a7799547b9727ee40c6d92a3eb5376ef34d9e

SHA512
65a9213780fec7e62b2e014369e4ad952cfb2c3e2f0a6c9c9b51c2901638d52be404f599927a4971fd803078b5ff6186c5d88969564f305d6f3004ce0d1b2aef

Download Submit