5c8d808659e303b572db4813d5d649f6c8cc16497c49eed8241d5c09cb1cf2d2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ecd6f094bdd6faf2e5f9add25d15938_JaffaCakes118.pdf
Size

34KB
MD5

8ecd6f094bdd6faf2e5f9add25d15938
SHA1

c448c25842428a40d67fac30d6c58df8db76a9d1
SHA256

5c8d808659e303b572db4813d5d649f6c8cc16497c49eed8241d5c09cb1cf2d2
SHA512

4f24494c8e06e6ecd49aac6b79c1035a77e9038b80a45e16fa15bbad84a5f83bc7b4e05de023332b66ef616317b53a4e125ed9df70c5bc9ec415a3567174dbee
SSDEEP

768:MVyPQha52bA3kxaz2v5wyhyzHp5a1RCl3ClQ:KyYh/xi2/yz03u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1384	AcroRd32.exe
1384	AcroRd32.exe
1384	AcroRd32.exe
1384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8ecd6f094bdd6faf2e5f9add25d15938_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cbbd152257e1e3d3d3d590b578fededb

SHA1
8c8d7cc3852364da02b264ce03c704e35566aee9

SHA256
431845073fdab4b399721067c5dea41dbf81cd7df01de84bdad7d3bc6063cc52

SHA512
9188020c7831c39329630bb2630ae8aa7d589fda05e0cfcb1733bbd065c1135b5b22bad51deef8711a962085737a70851711d8b6dab12cd90cf9f9e6304e250d

Download Submit