25f6ff89f42f68cf54bb4197947bbfc3b29bb3792ae159bc2198af45e4a5c1f4

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5405965a8fb0831bfbd1c68d159d235e_JaffaCakes118.pdf
Size

73KB
MD5

5405965a8fb0831bfbd1c68d159d235e
SHA1

cf73a1e376294882e97de9c47815a9f2e6aec9a3
SHA256

25f6ff89f42f68cf54bb4197947bbfc3b29bb3792ae159bc2198af45e4a5c1f4
SHA512

c67117bf2061d810b2a770504fa16547e3e440f368fedc227aad8bbfd5fd724d87951cdc23e6aeb2b86094bf776a8516c51e56f3094096007a57ac991fc05c96
SSDEEP

1536:yiCokQprXTw5QG/LhhrNIDhL0ct+2S4YWxx3nRp4vwjW8pO+lQL:zC4TTwdGhoctNnxxcvwK++

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1680	AcroRd32.exe
1680	AcroRd32.exe
1680	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5405965a8fb0831bfbd1c68d159d235e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
858b016d7df9e3a2edff449c865f1bb9

SHA1
05c7d197e30d6e25595648daaa16bca7a77089b9

SHA256
622df57ef349e0e47225af6672e9aa677ce7311bbfdfe9d421efa393cebc7a4b

SHA512
72be3208de7b73c182a7d8cb08fda1cbac201cfec3ed45dd6952eed8210d36d6aceced3449ee858e7aff65e7576cd3802e332aad773e875b1a46d4130dfa3acd

Download Submit