5fd3386a5374086a5f51268dce362c7f9054e39a4ac48fcbefadb53ad1d08a5d

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adb30eb2c455dcf4f59e1e07905a1428_JaffaCakes118.pdf
Size

79KB
MD5

adb30eb2c455dcf4f59e1e07905a1428
SHA1

8f502c51c7fb77389c1b24789aabe442a58b711c
SHA256

5fd3386a5374086a5f51268dce362c7f9054e39a4ac48fcbefadb53ad1d08a5d
SHA512

8a70041f5f6e50cefaea2529b45a18158cd9bf4276773ca3557b994b2c4239c754ffac58a9bbc3c7c64a9288e98b96631995565d81109a014639044bd72cbe4a
SSDEEP

1536:FG7T/I6/Odrwy9/KExjnFfkktcYtV8tHBWX7bDWkpOTOwU:oo6/Oqy9yejnRkktcaV8tHm/iTW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2200	AcroRd32.exe
2200	AcroRd32.exe
2200	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\adb30eb2c455dcf4f59e1e07905a1428_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
19a7902e100cb1c4d39afa9be34aba7f

SHA1
e90c500a8187508b060aac1d11aa7153e71511c4

SHA256
a53af87195365084b086a07966cbb34234807c9fbfb217db491a6f64d3a91a7e

SHA512
5f79412aaafe6edcca3acfc48c3bfa1bca754c1933ed4d1ae907caa1fe37a92a62f75b87468155dc33528ccd9f0552de3da1357d9b0c3d7a3a7027e78762b303

Download Submit