7cd2c488cff6d54758592e9f3e37627827af4d4a936ddcb75b1179da16d6b1ca

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d796554558f488f4e6a8535b1b595493_JaffaCakes118.pdf
Size

83KB
MD5

d796554558f488f4e6a8535b1b595493
SHA1

fcbd6f3926360d673f0abeb9801be53e0e1c2fa4
SHA256

7cd2c488cff6d54758592e9f3e37627827af4d4a936ddcb75b1179da16d6b1ca
SHA512

0b80dd17e07b47895c7d7d5e0566758b2203765d5d3b0d48081383008660d96509971787a39b3ae1302dfe24f5ed3e503e3f8344564bdb2d3088d1430b5954f4
SSDEEP

1536:XWot1xxVpRP2bDrFQmTBqAtHUGK53qiLV5PjtSdaWMHFCIdbBcqxG8W8pO+tuY:dzxxVpwbBNo53qiPjtSdu5bBcSG3+r

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d796554558f488f4e6a8535b1b595493_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b59068b61e1bc17199619a59f486c52

SHA1
1985d1efdf8f5cac356f472fa175f7e9b2740722

SHA256
139dd7f6883ae329ebc4bdcf65a03557160364c815248c4dbc446cab39517a7c

SHA512
3bbe262aaa33c0d556c7681d74f09053e8ed4842979a2fd43b51fd34099e2783dca04acb399d95c68c342e817e155e8e255331fa4ae59a6a8666e330116039cc

Download Submit