23b5236dbcf33b1a59aed8f6e034b732667580fc6b288b8cf9ec82cdc288e582

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cac3cdd580a07ad1ae63e11c2a37455_JaffaCakes118.pdf
Size

87KB
MD5

8cac3cdd580a07ad1ae63e11c2a37455
SHA1

89446a5e9e14cde5b6b58a8cc85f97078352f21a
SHA256

23b5236dbcf33b1a59aed8f6e034b732667580fc6b288b8cf9ec82cdc288e582
SHA512

d9d1d55b002e9c5a7c61ef9af402fcc18635a7b23494380810d9503be0c7e50efa4316c561efab1ee98ef99b3cc3939559b8ea579a1e1cab72ce8363345abae4
SSDEEP

1536:7p2vaA2KHme704LJIQ0DqOVklCfAiTPGtPJIkk8gR6WWCpOViKF7WlqEC6ROIIh:N0apTOCQ0Dq4fASurIb8nLViOeqYRO/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2988	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8cac3cdd580a07ad1ae63e11c2a37455_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bbaef973eda1e36425bbc0d5cd32beb0

SHA1
6fae359d373cff2898334f7320a84b9e1805d6b4

SHA256
797ed898b19405fdb1b18e71b5c9b269c27dc90e0c6e49a0344a0266785910c8

SHA512
36cd5d337a5f35144d0f6bddc8f5ba2f2a5ed954195ac0ca1233a076bbd837cff4f72c9a5c12ba8652a289fcb0b0565bc195d59c25062ddd18fc0959f2f90e2d

Download Submit