2b8f6ff19027348d722c0c13b6cedbde998ade4fe31fd831e7210d3cb78cce37

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84598af001584803b2d5ae241e2eb9f9_JaffaCakes118.pdf
Size

71KB
MD5

84598af001584803b2d5ae241e2eb9f9
SHA1

4db7cc19fcdf9b5f6dd5210e6d1f26535813bec4
SHA256

2b8f6ff19027348d722c0c13b6cedbde998ade4fe31fd831e7210d3cb78cce37
SHA512

6ee55385976d95835885e23dec2e2963797aa3505b7bdb897339c63328b118f1fb7497e3e63d8c4bd6ca91c423f87c0f2612013542720cfb8859194d4198e459
SSDEEP

1536:JIB1W4My0QLF6pMeplUCt0oSTMZWbpONiWK23UelU8grrOZ:4s4LLkfpyS0oSYbNB3w8grw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2516	AcroRd32.exe
2516	AcroRd32.exe
2516	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\84598af001584803b2d5ae241e2eb9f9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
04dc123076f3143a2055e6fb16a867f3

SHA1
0167b4ec1ef64e8a7d885f06da2d26e257e18779

SHA256
ab0d9015b9d3cf61d5713f6833a859b8d0f497852bbb5ccdd77609b251f36865

SHA512
2543cc95b6bc7aa1dbb781bc9b82a050e2a340b94a90241873711e3e8df2955acbd2a1a9ffaee6e94f32b5d24f5bc4e381f6f77011f759d27f634c12a120a9d5

Download Submit