1c2351153f5690b8ac07a07cd1dadd01816848e379d03951a746e091597c8e46

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83271b61f18144a6e23613dab0fe3cab_JaffaCakes118.pdf
Size

41KB
MD5

83271b61f18144a6e23613dab0fe3cab
SHA1

7fa2191079104870dc52ea1953c38b2df0e26c29
SHA256

1c2351153f5690b8ac07a07cd1dadd01816848e379d03951a746e091597c8e46
SHA512

23fa2959266a34fcdd1280b4d82b7e6f3de785b00b6665e3c267a08b527ddfef45a9b46a7905a5cc1edec60c53016c3000b84c79f98860e3d50b69585192f357
SSDEEP

768:oFgGzpD8eX/Zz+lQBZ1a/6Bco6aY07xvbF+geUOqlF3Rl:5GFgeXWO7xvbFjlF3Rl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2608	AcroRd32.exe
2608	AcroRd32.exe
2608	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\83271b61f18144a6e23613dab0fe3cab_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f3394576c1d9338dc53e060f66ff66e6

SHA1
148c452c9e0c40440bca38a8c50683b41bf4a0db

SHA256
969e9b95d1aed349b2063fbbc7ad468cc961a78ebd21347e52091a7176fe4c4b

SHA512
e5ba02c6819df0e28383b4e3010fc6e093eb5814f269142ec8aae56433fc82929bbf8e3ac17f705ab9420ec6aec7b4e12451e7feeef2991cf835d6d1a8fd8f99

Download Submit