b60803665daac982129dcfb1ebeed80ffffc67992548cf253a5068fa99cf1f78

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

843d3ae8197ecaaaeb62f900421edf45_JaffaCakes118.pdf
Size

70KB
MD5

843d3ae8197ecaaaeb62f900421edf45
SHA1

9a7bdd8895499ab2fbc5bcb6ee344b7beeb28b0b
SHA256

b60803665daac982129dcfb1ebeed80ffffc67992548cf253a5068fa99cf1f78
SHA512

bd67ec81e8d6ad95fac720c1b6f090d0d26329bd7cba19873f619e7580e3ce66b453f6e16a80cca407611e8e08f6112caeb4d68017d6d80ae8ec6ad29ea95ed4
SSDEEP

1536:VAxbk7gRzAkzVhqgCmmDZf9yAita3W8pO73WWwWxmRdV:ix1AkzVhcDXN6aK7kZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1628	AcroRd32.exe
1628	AcroRd32.exe
1628	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\843d3ae8197ecaaaeb62f900421edf45_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8347a8e42d50d79914b46ad14da8f3e0

SHA1
016cc369584e89db7a2a0c8988ddbf234c338e7f

SHA256
913208c7a84894770ba6f4774aefc99d2e6eab8f772fa16fe8ce23343d8f5926

SHA512
51c18a64b0194d0e0e5b354f37e1c07055eb0911b2bdd31ec0d879e73d3172291a311519441e5f41e6348cffc501a15ffac02a9fca3ac2b0b52e734600bbdcea

Download Submit