a8e0db818554ef817fe948f6474ecc7827b3db3410b6cf99eedb0c0eeb5f6359

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a0935607527a2a5213e6f268093703f_JaffaCakes118.pdf
Size

73KB
MD5

8a0935607527a2a5213e6f268093703f
SHA1

c6acab4f7968042b3fe65a571104ed02896674a9
SHA256

a8e0db818554ef817fe948f6474ecc7827b3db3410b6cf99eedb0c0eeb5f6359
SHA512

b0c607b8caeda319353adb7cce2452a9cc2deeaedb99846e90a5e03ecc1dc5f7b66b87a03bb9bfe104907c305bf275f97b6717689b7da30fcf03c17e8082de42
SSDEEP

1536:gc2TI7JrY8ReUCcKF+AxvcL764OIX53sTYr8qWGpOKUVXW+MCbuGtNZ/F0i1:6TIlYGWcK0AhvW3WDKUVDx/D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8a0935607527a2a5213e6f268093703f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c4b97b290a175d0b74d7f6241b840cfe

SHA1
55c20c8435d9bfa6f9a29e5d1c675f6bc3164a71

SHA256
ba4234e801cf736369075bb879f07a85bd23d76150c50fb1df9caa71a28a4b21

SHA512
9b34a95ca2e236e246e7cc0428a872a81b75273b719df59616ef9afe3302e37c24bd946d18c9c4e4002edc3c69f8b645e4abb180fa58e438dac4c80349fa5591

Download Submit