ee452661307065f233fff0f3232316ef86399b4163a01985e95ab25a8e99d433

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aad1cd67881f7d67125632bf348c64cc_JaffaCakes118.pdf
Size

87KB
MD5

aad1cd67881f7d67125632bf348c64cc
SHA1

2f2c15793a4cf4db16806232635f42b6231aaa01
SHA256

ee452661307065f233fff0f3232316ef86399b4163a01985e95ab25a8e99d433
SHA512

0ccb38069bafaa789b4477045bed60ef1fe210a603daf70c37c24075510230820ec69572bb662d65097d562d24915ac428d41650eb3974136f4928e884a13067
SSDEEP

1536:ajEA8d/jOS8lhwG9uxplXyPUcXw15o6Lj84WhKLURWypOlWWxaCrKz7oncoT+C:ddbOSGD9CwMcXY5o6LoHAY6lDTKz7on1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\aad1cd67881f7d67125632bf348c64cc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
869473be504d8f1424517aa7f8fb22a8

SHA1
eaeccb62752aaf2fe5c305a43cc4b61e09f62908

SHA256
b90665c352e648ca35fa4ef03a550b7d5cf25f4911e3e384fdb1d48d01b18078

SHA512
a972be48c33facaf03e583606aa5a7f3f9145574fd1a475524f118e5fbc6b02d747287b1ea5d98b3e76e59fd344c55b1a8cc1dd497ccd66258ca25c7f96e754a

Download Submit