bee138cd6f5c0d5ea25ba80b6bf3efaaf90bf7478c96b250685c248021676e1d

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69de51b73841cf9f2ce46a3d3309d27a_JaffaCakes118.pdf
Size

48KB
MD5

69de51b73841cf9f2ce46a3d3309d27a
SHA1

a92fe8a9f6555ee8bb0b4a086f49a35021f7bfbe
SHA256

bee138cd6f5c0d5ea25ba80b6bf3efaaf90bf7478c96b250685c248021676e1d
SHA512

6938351435368063004d75cabb50c02c3189e07b197807560bacd075eb1b56b12b8a0ab44aaf1ea920bee0e9f565635bcc6d4a0a16ad66a92cbfe7c8ef612ed1
SSDEEP

768:1hEGyPYhd5F9Fno5b2KTqjI9jm23AH8QOk1SFktnMbTHE9pikLTJJyadFd:1nyPYT7Xno5CKTKh23AcQD4kMbrqiKF5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2200	AcroRd32.exe
2200	AcroRd32.exe
2200	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\69de51b73841cf9f2ce46a3d3309d27a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
76fb29c44fd987153b5a65a9b9f89c5e

SHA1
998777b026db3b4adf5c47e5f4158de06a642ab8

SHA256
9e13b4569f4fd74159e166da0815bfeae195a285590d856e6514511313667557

SHA512
f55ec6e635b01257448aee6cac35e99c2ac3a48ce0ef16650eb98827fabf6f021e1a53b85bcbb9265e2c3ac3b435c0c54a77b15b58566e80050facd8dbfbbdec

Download Submit