d364abf3cfd21f6a7bf3238a709a9ea53b16205a7a29483451d8e12b79651a4f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a34f368be370515a022e154f60c14636_JaffaCakes118.pdf
Size

70KB
MD5

a34f368be370515a022e154f60c14636
SHA1

c8499fa1dcf170718c763fa37e7da1530c2e82af
SHA256

d364abf3cfd21f6a7bf3238a709a9ea53b16205a7a29483451d8e12b79651a4f
SHA512

33275cef2b8a21bf1f5280d7eca8ceef5170e55250ec0a0556f97d425a6513d8880521ec439dd13f8024ddfde69c2798378211c6877efb425a9779aef6ce52a0
SSDEEP

1536:z0XYX/8SwKxajY3cbAUq3nakUJGF2Co5bGEZfLUkA2a6OqOpBHY:YohsYsb962Cb2a6Oqau

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2064	AcroRd32.exe
2064	AcroRd32.exe
2064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a34f368be370515a022e154f60c14636_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e570b1cf1b5c2ab326c9f76f20601c14

SHA1
6ee4daeaad7521126637168d1518d4c23b748968

SHA256
118583c3c2cf7fa0abedd04deb70ad504cc88b220b2f9d75f734b4bd7504b9e0

SHA512
adfa16db2465d82e8bfd9ab70e5399e4e950c556d54aef822535216cc2ffc8df136abb18e000b3152bf3f391042d5d1eba0a7afed9d6e605e7de990cfd2c2e87

Download Submit