7c4138f5abfb96e2c5bb6fe8f4d0757031b00c003acd2bdd1e095470c4c8b22d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42014757b31b04dfa5093da4430c4c7b_JaffaCakes118.pdf
Size

85KB
MD5

42014757b31b04dfa5093da4430c4c7b
SHA1

ed7d636b9064f4d12558bc4bd2c4f8a5c1668716
SHA256

7c4138f5abfb96e2c5bb6fe8f4d0757031b00c003acd2bdd1e095470c4c8b22d
SHA512

71744db38b59b99379f8e7748eca99bdfdeb58e5935c1af9d5cfc499ea946d8c5afc492c910c983294377d688b9c7125bd8b29fd365fadf19f37fd10a779a3c5
SSDEEP

1536:i0mTKmksQGnlqX0Sw4E0EBYPxIE0cYPnixX5CMaf2W3z5T8kSbqSSxweDWepOZs6:37HE02MR0c8ni/CMafP8nbqJxDEZf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\42014757b31b04dfa5093da4430c4c7b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
68de131acabdb4a9ce6547cae33fe44d

SHA1
4e7be9c84b36cf50fdd289e8dec20917e6be07e6

SHA256
e3699bcfd929dafa16ec22b34f8dc69d3f506abc296feeab629545923a422dce

SHA512
3a4745757ba8cecca649e8ac995e3011bb9a15d48eed8a6919d0ab7df8a397a86834027d544421093ab39a33eea952407edfc0df5279f2939937289f1279e54e

Download Submit