ad0178b3723fded224fe8e7da3d72f288f0997950ef798d9077e871612172c94

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0291a2cd5e17ba1f92d72738d94f157_JaffaCakes118.pdf
Size

32KB
MD5

b0291a2cd5e17ba1f92d72738d94f157
SHA1

6b5236b91ed3dfc1b291f92b4cf7ebe04462f55c
SHA256

ad0178b3723fded224fe8e7da3d72f288f0997950ef798d9077e871612172c94
SHA512

23c07a12ce1b5d48a08d440e18a1bbfb8cfa9f8a4eeb53f33fd90f729c35708f10d7c8a508a74d18d756cf536096e0e243e6d9defd3476dc6bd6155d002deaa9
SSDEEP

384:E/QON8MUG6Qgw0JZCTzz02YFnarX/fsTuKWK0i1evKDuDKJk/VvzDV2jz+IKaE7O:EXuMZmwgCLWar/YJkN/on+IbEc+f4p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1328	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1328	AcroRd32.exe
1328	AcroRd32.exe
1328	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b0291a2cd5e17ba1f92d72738d94f157_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e548fa5f2a008c147d7690840f06c251

SHA1
7eeef665e0756abef4ce5cfd4e4c9b0d7b67e965

SHA256
bac26ca176e2c481d6b6baa9d0da2898cf58bb1bd119b4fa96dbf0cc4eae5ac7

SHA512
1be6414ba591ed92e0f97e557c84495017478f587683311d4ba9d6f240ae87da1929ff7092d96695cf3adfadee56a82292acf169e797888fe8420c8a9db73c16

Download Submit