6311f55bec6c9ae922685d8656d9045cd371190c87045d24de39eb9e9fdaf355

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b13f9d8ca91c8c48bba730d870209351_JaffaCakes118.pdf
Size

85KB
MD5

b13f9d8ca91c8c48bba730d870209351
SHA1

e348a52e55c27ad8940d987c6e79a34b1cac517d
SHA256

6311f55bec6c9ae922685d8656d9045cd371190c87045d24de39eb9e9fdaf355
SHA512

9ba8e0747941f0f81e5344b148ecc392a2efbbbe655ceed41dba33d3eca335364769c6c5d43858646aaa301c7b4acbfb92439952592e009b19cd6d339513bcf2
SSDEEP

1536:YYA3SN1IUR4vBsor4oCCfAAsBASWHpOvHtj3O4KWByY89Pjf2d8:vRvLoEoXfzZSvHtS47yzf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b13f9d8ca91c8c48bba730d870209351_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
75469ba18acaf68047e022b351742845

SHA1
bfdbe0040f360cd9eb0f4d9333e20a41feb13e5e

SHA256
cb3fdb74ca2ec9f70c519b3080d49a6b665b49cb864479cdba9551a7fe8c5e7b

SHA512
77445ce8e25d48e963c787df30d0811365d6e9d99a147929dd5fe0c21bc8f0e494ff79a4658cefa1c5d313c38fbd386ccb83c64570bf6bb8014dca0da9a55dd9

Download Submit