a662d452ec5c953e392e964e52bc57bc4cb865ba326dbedf33497008522ba509

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88efbe9bef873d12138a97d1e430e111_JaffaCakes118.pdf
Size

76KB
MD5

88efbe9bef873d12138a97d1e430e111
SHA1

497afabdf70f9cb17af41de487f0ef844c603d4d
SHA256

a662d452ec5c953e392e964e52bc57bc4cb865ba326dbedf33497008522ba509
SHA512

aa6302b6789e6877738a5cd7c71430f1c2a1613ff0435d8f30edd7c94cdbf6e56e9ce00ee4c24152096023ee798c3b5d861e213fa117dabfe63ecd0676b3cf24
SSDEEP

1536:fHnlkuR05h0ybbABqo+Zvp8r+eT1O6InZS02/HxOqcU4z5qV6lWvDRIZY:PVa5WwAwo+L8rj5O6IZEUqYz4QlQDT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\88efbe9bef873d12138a97d1e430e111_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9df17bd598ef3605b74c02afd38ea161

SHA1
64af7c1627086833f01a08b4b7944e974e4b7120

SHA256
9d6382f5fef8ddd8bd2b1677d75d1352cc24342da0563063d7226eff94b18fd0

SHA512
e2cca4d54d77e84b963717a59959c81fba542c41ff3b616d2158ed0645f64c14c2cb20809548f448ad0d894c24c02f15a5dcf5c60a9511f6791608526238aacc

Download Submit