23204b4b43aaa06a4718d2ae930c296ef735d708816a52cbb6e107c523dede6f

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b01ca29241e7e0834949a89445b2fcec_JaffaCakes118.pdf
Size

93KB
MD5

b01ca29241e7e0834949a89445b2fcec
SHA1

35a3c8e452ca689057e9655583c37b42f90e87ce
SHA256

23204b4b43aaa06a4718d2ae930c296ef735d708816a52cbb6e107c523dede6f
SHA512

fd4572805bbdfe5ec6cdc841c05b69d607ed0fe411e231c04e72a62cb443b4548daa8778a768332cf36eb6b06ade590d8cb313d2a430257b667e17ce56ac76fa
SSDEEP

1536:DQ1h7IRkdAhoCGxPlYsUaWq++TtD24vWrUEfmWxWapOn6WYMEgoMWQpu:Q7IRgAuVxPhaq+SNOnflynxzlW9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
900	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
900	AcroRd32.exe
900	AcroRd32.exe
900	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b01ca29241e7e0834949a89445b2fcec_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e87cf8c935a3cfde9a93444a0de5a8f5

SHA1
56e6b666c8f61d680aa21045f96c3d2c8b1899a9

SHA256
8794a7307c88997bfd0907736835eff50025b573689b19a5b71e7da091cc5629

SHA512
84de97af01caf531ddf364a2335378383f72a13e1cf89cbfc96fb339cd3f0ecf9b4cb17131a61005142a5afe09a740e49cc75d5a03a6aa64231d37588d8d573a

Download Submit