b59272341e945af14a145d39f018b68595443989d4eb7feef28188f93b0101c9

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68e13a4100563bf7bd4a3123bd484574_JaffaCakes118.pdf
Size

97KB
MD5

68e13a4100563bf7bd4a3123bd484574
SHA1

2dce24ff64635d17dc52797b0509d86ec1893af8
SHA256

b59272341e945af14a145d39f018b68595443989d4eb7feef28188f93b0101c9
SHA512

1d469edcc5b1722e14a8932adb71ea31e93695d61434b375b38c46ea215d30693fcdf4fc68b0680e5e931c63c1b758a86d3c7b2763b1c6c1341f0c06f288e018
SSDEEP

1536:Kn7485RKWRUqBdK/qqWNeKF6INv3dFCJYMx2+vjxeI31rXxHbnVqj+UbWhUS3X:Ek85DiqmqFLF6CnM7xjxeIjH5i+UQUy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\68e13a4100563bf7bd4a3123bd484574_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30cdb7fb19ea0273a581dd73892cbc33

SHA1
3bbddfc222e8f15c3e9dd84e38adbc2f7d1e808a

SHA256
31f30506427aacccca0d78a45688eb1fa4f8d8ca1e3930ee6ebdf43a00517889

SHA512
ba2fcc02120705577ae57a7c48bff4c235768729c711a9d92b0dbe60b02cee5a620028a439398adad41141d01d760bcea3e50f953aa84612e554ee5269c04d89

Download Submit