b26f7df4245341423f325e5cbd753342febac702ff42602a2e0efead2fe17339

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69f187639b71e9af0ce0f14df3c217c2_JaffaCakes118.pdf
Size

84KB
MD5

69f187639b71e9af0ce0f14df3c217c2
SHA1

b50b695043adde4b8fe4c9d662e718f449f706f5
SHA256

b26f7df4245341423f325e5cbd753342febac702ff42602a2e0efead2fe17339
SHA512

303adae2be319cada617873c142f4886b441f77bd4224462ce06d75987522a165f7b89b46875c63ee1db2a29cca920aba013dc706d1333ea5e3eae56a636e43c
SSDEEP

1536:Fyf6fT8jcAHmLiurXeS5wIT1mUP1xFrlRwWem8wwP+Wvh+tihUbmyW8pO7YSp:k6fT8jcF5r75/TDZrQWem8wwr+ASmZ7/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1868	AcroRd32.exe
1868	AcroRd32.exe
1868	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\69f187639b71e9af0ce0f14df3c217c2_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
54c92f9a20cfc4a8cb1d25ec3abae118

SHA1
ba36092ebd5fa029ffbfd6036eab6781e54bbbbf

SHA256
1748a86c0445527de279602b6074b759e1901313b482f5d1c16fe903d641d18d

SHA512
220b67819006e85a5c060b0f2f3c61d5d91590a52406c1652e0f1e108b939a5f5e3b0cedf0ab3fc5b72c2d3ea70c47ecd728a0fbc28bee57c526b3f9bd8532a2

Download Submit