22be4672feb2d7a13288b672ff7caa8da2d97805ac90d7df9bbf32df73ac201e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

464b8875c7e80a37d9ad7b56c125ba6b_JaffaCakes118.pdf
Size

78KB
MD5

464b8875c7e80a37d9ad7b56c125ba6b
SHA1

4ed302fe02fc329f2ec80dc2beaf5ec39369f3e9
SHA256

22be4672feb2d7a13288b672ff7caa8da2d97805ac90d7df9bbf32df73ac201e
SHA512

18b68f7c6928994f577b2fa25c8c9699b8bc922ae5a2c93a0bad6719e35cde9b531006ed6e3148afa9d40ed5eea6934ffdf1437ab738ab203848f935327bceff
SSDEEP

1536:YvDukXYlvxv3ndXEcXiiH9wuPdqUlb+kiGdSAD6SYJ1a5QRIhu0JoKs2Cryv:QtsvbXXXi2P5CTQZDYgQRuDaKsw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1476	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\464b8875c7e80a37d9ad7b56c125ba6b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8bd15377cec8e4022459558b1aa3aac2

SHA1
fa39e10cd76944877f60fb8101549c439ea0a9ed

SHA256
15ab3cd299b05fd19fa11f3234597e5fb2d505125b763c14b4f6cce54de32dbf

SHA512
2a2fd8d346ebd382504e035241ed245594bb0895eae8b0bd07447336785a284a549f8d018b2eea42d2a352a3fa16842627d8199da255355d4588b94a47f98fee

Download Submit