f8d76fd38471090d0e51151552019614d3b6feae90448e0f57e75c50a7f08f9d

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b48d439e3564219cd84580834dbd075_JaffaCakes118.pdf
Size

72KB
MD5

8b48d439e3564219cd84580834dbd075
SHA1

eeeb0d15a54694d8d0828b04f5e60e104d67bed8
SHA256

f8d76fd38471090d0e51151552019614d3b6feae90448e0f57e75c50a7f08f9d
SHA512

1513a4d46b60f5f5f05dc3a76863c5d19410f7e6fc817b318c2a56ac09682b8f8aff79c195b5b8784786655b25e8ef3beae5ea1fcbc50c67921fa7b59503689b
SSDEEP

1536:LBb8pemucoD+n5zlpt8VkGo1ckQJBfQCX/+yo4D866WaXTr/gwWQpOCXw7:KpemuVDEBecckQTQCrDvkn/gfCQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
600	AcroRd32.exe
600	AcroRd32.exe
600	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8b48d439e3564219cd84580834dbd075_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6c007e3212760ae790b3554684dd786c

SHA1
a9419d0dad57f394b87ebcb2455eb467851380ab

SHA256
79e4506a5fc4c9fbe5dffb3263447f687356e75f9bdafc362ce3eaa58657dd7c

SHA512
06474806a6debca04d285a269f0933c4b809d0f89acf02f8b3060d835086b81078911d490e53ab12735f42bcb220058f7ca59b18c4ac16498fc397caecf5dd9e

Download Submit