7a4bb76373b53f9ac648f6ea68258ec206669b6b7e49ce6c437aacee1fe26a82

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4067607cd8c395ad46c61c7e07d12e9c_JaffaCakes118.pdf
Size

81KB
MD5

4067607cd8c395ad46c61c7e07d12e9c
SHA1

6034ccf88202a559440ab56b79bc1a03d37df217
SHA256

7a4bb76373b53f9ac648f6ea68258ec206669b6b7e49ce6c437aacee1fe26a82
SHA512

592392a9e548d6bc8e131376d0c4f1746a6d6d3ab5eb3a5490ba1fe86fc41d0240809e4e2a1ec2084b75f35c66445d0c9d67443574994bc32fdf2adba8d9dfc0
SSDEEP

1536:2tMqLQA86V5lYOmDGlxT2O9nyVC16TkhWbM1UhrKSWQpOCjvDKhqdFU7wJpJ3Hl:GM+QOV5iOmegO9nyVC0DhrK1CXKhqdFD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1992	AcroRd32.exe
1992	AcroRd32.exe
1992	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4067607cd8c395ad46c61c7e07d12e9c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b85a38867fec62811ff28991eb9593c1

SHA1
69f04f1ccf38a35daebc29bc4fe126fa894211b0

SHA256
509b890c6492f1b3e9982e61fd2d40c03ca46da1a3c207190280d6a35cffbe28

SHA512
6d9bfcef12d06d58d0d9831765654693b52ae5e5278a6411b2d762cc71deb92b70d0e1afd9cd30d3de1530a9d42dbbd15e18e1ff7d911c8e41862527c4dd1e52

Download Submit